ComorosLaw on the Protection of Personal Data, transfer to a foreign state
Loi n° 14-029/AU, arts. 9, 43(h) (cross border transfer)
In force.
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Do not transfer personal data to a foreign state unless that state ensures a sufficient level of protection for privacy and fundamental rights and freedoms, judged by the protections and security measures in force there and by the nature, origin and destination of the data.
- Obtain the Commission's prior authorization before a processing operation that provides for transferring personal data to another state, even where you rely on contractual clauses or internal rules to show a sufficient level of protection.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 9 allows a transfer to a foreign state only if that state ensures a sufficient level of protection, judged on the state's rules, security measures and the nature, origin and destination of the data, and Article 43(h) puts a transfer under the Commission's prior authorisation. Neither article requires the controller to keep a record of the assessment or of the transfers, or to produce one. The articles have no territorial clause. The Comoros text cited is the law as deliberated and adopted by the Assemblee de l'Union on , reproduced by ANADEN; no promulgation or Official Gazette copy was read.
- Kind
- None
- As of
What this law does
Article 9 bars a controller from transferring personal data to a foreign state unless that state ensures a sufficient level of protection for privacy and fundamental rights and freedoms, judged by the protections and security measures in force there and by the nature, origin and destination of the data and the purpose and duration of the processing.
Article 43(h) requires the Commission's prior authorization for a processing operation that provides for personal data to be transferred to another state, including where the transfer is grounded on contractual clauses or internal rules said to guarantee a sufficient level of protection. The Law names no day for its entry into force, and no promulgation decree or commencement notice for it has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .