LebanonLaw No. 81/2018, Part V, transfer of personal data to another State
Law No. 81/2018, Arts. 96(12) and 98(8) (transfer of personal data to another State)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Disclosure
- Audit expectation
- none
What it requires
- Declare in the permit you file with the Ministry of Economy and Trade any transfer of personal data to another State, in any form, that the processing involves.
- Keep that declaration accurate for the life of the processing, because the Ministry publishes the personal data intended for transfer to a foreign State against your entry on its public list.
- Note what Lebanon does not ask for: no adequacy finding, no standard contractual clauses, no binding corporate rules, no separate consent to the transfer, no prior ministerial approval and no duty to keep Lebanese personal data on a server in Lebanon.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 96(12) and 98(8) require the permit filed with the Ministry of Economy and Trade to state any transfer of personal data to another State and the Ministry's public list to show the data intended for transfer. The permit is a filing and the list is the Ministry's, so these provisions require no record of transfers to be kept or produced by the processing officer, and name no review of one.
- Kind
- None
- As of
What this law does
Article 96(12) requires the permit filed with the Ministry of Economy and Trade to state, where appropriate, the transfer of personal data to another State in any form, and Article 98(8) requires the public list the Ministry publishes of authorized and licensed processing to record, for each entry, the personal data intended for transfer to a foreign State. Those two items are the whole of Lebanon's cross-border regime.
Neither conditions the transfer on the destination's level of protection, on an adequacy finding, on standard contractual clauses, on binding corporate rules, on the person's consent or on the Ministry's prior approval, and Part V nowhere requires personal data collected in Lebanon to be stored on a server or in a data centre in Lebanon, so the duty is to declare the transfer and keep the declaration accurate, not to justify it.
The declaration is still load-bearing, because processing without a permit, or outside the terms of the one filed, is an offence under Article 106 carrying a fine of one million to thirty million Lebanese Pounds and imprisonment of three months to three years. Article 136 makes the law effective three months after its publication in the Official Gazette, so these provisions bind today.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .