LesothoData Protection Act, 2011, transfer of personal information outside Lesotho
Data Protection Act, 2011, s. 52 (transfer outside Lesotho)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://lesotholii.org/akn/ls/act/2012/5/eng@2012-02-22In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before transferring personal information about a data subject to a third party in a foreign country, confirm the recipient is subject to a law, code of conduct, or contract that effectively upholds processing principles substantially similar to this Act's, including onward-transfer protections, or rely on another listed condition.
- Obtain the data subject's consent to the transfer where you do not rely on the recipient's equivalent legal protection.
- Where the transfer is necessary for performance of a contract between you and the data subject, or a contract concluded in the data subject's interest with a third party, you may transfer without separately meeting the equivalent-protection condition.
- Where the transfer is for the data subject's benefit and it is not reasonably practicable to obtain consent, confirm the data subject would likely consent if asked before proceeding.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 52 bars a controller in Lesotho from transferring personal information to a third party in a foreign country unless the recipient is bound by a law, code or contract that upholds substantially similar principles, or the data subject consents, or a listed necessity applies. It requires no log, register or record of a transfer and names no check of one. The section has no scope clause of its own, beyond naming a controller in Lesotho.
- Kind
- None
- As of
What this law does
Section 52 bars a data controller in Lesotho from transferring personal information about a data subject to a third party in a foreign country unless the recipient is subject to a law, code of conduct or contract that effectively upholds processing principles substantially similar to the Act's, including onward-transfer protections.
The prohibition also does not apply where the data subject consents to the transfer, where the transfer is necessary for the performance of a contract between the data subject and the controller or for pre-contractual measures the data subject requested, or where the transfer is necessary for a contract concluded in the data subject's interest between the controller and a third party.
The prohibition additionally does not apply where the transfer is for the data subject's benefit and it is not reasonably practicable to obtain the data subject's consent, or where it would be reasonably practicable and the data subject would likely give it.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .