LibyaLaw No. 6 of 2022, cross border transfer of personal data
Law No. 6 of 2022, art. 78 (Electronic Transactions, cross border transfer)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before transferring personal data outside Libya, give due consideration to the nature of the data, its source, the purpose and duration of processing, and the destination country's international commitments, applicable law, rules, and security measures.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 78 requires due consideration of the level of protection (nature and source of the data, purposes and duration of processing, the receiving country's commitments, law and security measures) before personal data is transferred outside Libya. It is an assessment standard for a transfer and requires no log or record to be made, kept or produced. It states no territorial hook of its own.
- Kind
- None
- As of
What this law does
Article 78 requires due consideration of an appropriate level of protection before personal data is transferred outside Libya, naming six factors: the nature of the personal data, the source of the information, the purposes and duration of the processing, the destination country and its international commitments and applicable law, the relevant rules in that country, and the security measures taken to protect the data there.
The provision states a multi factor due consideration test rather than a prior authorization requirement, an adequacy finding, or a localization mandate.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .