GuyanaData Protection Act 2023, transfers of personal data outside Guyana
Data Protection Act 2023, ss. 23-30 (transfers outside Guyana)
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
As of .
What it requires
- Once the Data Protection Act 2023 is commenced, do not transfer personal data to a country, territory or international organization outside Guyana unless it provides an adequate level of protection and appropriate safeguards under which the data subject's rights are enforceable and effective legal remedies are available.
- Base a transfer on a section 25 safeguard, such as binding corporate rules authorized by the Commissioner, standard data protection clauses the Commissioner prescribes, or contractual clauses the Commissioner authorizes.
- Rely on a section 28 derogation, such as the data subject's consent or necessity for a contract, only where it applies, and where you rely on the compelling-legitimate-interests derogation in section 28(2), inform the Commissioner and the data subject of the transfer.
- Do not give effect to a foreign court judgment or administrative decision requiring you to transfer or disclose personal data unless it is based on an international agreement between the requesting country and Guyana.
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 23 bars the transfer of personal data to a country, territory or international organization outside Guyana unless it provides an adequate level of protection and appropriate safeguards under which the data subject's rights are enforceable and effective legal remedies are available. Section 24 makes adequacy a question of all the circumstances of the case, including the nature of the data, the destination, the law in force there and the supervisory authorities.
Section 25 lists the appropriate safeguards, including binding corporate rules, standard data protection clauses prescribed by the Commissioner with the Minister's approval, and contractual clauses authorized by the Commissioner. Section 26 requires binding corporate rules to be submitted to the Commissioner for authorization.
Section 27 allows a foreign court judgment or administrative decision requiring a transfer or disclosure to be recognized or enforced only if based on an international agreement with Guyana. Section 28 lets a transfer proceed without sections 23 to 25 on listed grounds such as the data subject's consent. Section 29 makes contravening sections 23, 24 or 25 an offence.
Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions. The Act was gazetted on following passage on . No commencement order has been located.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.