MonacoLoi sur la Protection des Données Personnelles, transfert des données
Loi n. 1.565 du 3 decembre 2024, arts. 96-101 (transfer of personal data)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Access restriction
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Before transferring personal data outside Monaco, confirm that the destination country, territory, or international organisation has an adequate level of protection, and treat every European Union member state as meeting that standard.
- Absent an adequacy finding, rely on an appropriate safeguard, such as an executory international commitment, standard clauses the Authority has approved, binding corporate rules the Authority has approved, an approved certification mechanism, or an approved code of conduct.
- Absent both an adequacy finding and a safeguard, transfer personal data only under a listed exception, such as the person's informed explicit consent, an important public interest ground, a legal claim, a public register meant to inform the public, or contract necessity, and tell the Authority where you rely on a rare, non repetitive transfer touching a limited number of people instead.
- Get the Authority's authorisation before a transfer that rests on ad hoc contractual clauses or particular safeguards outside articles 97 to 99, and treat its silence for two months, renewable once, as a refusal.
- Do not treat a foreign court's or authority's order to transfer or disclose personal data out of Monaco as enforceable unless an international agreement between that state and Monaco provides for it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 96 to 101 allow a transfer abroad on an adequacy finding, an appropriate safeguard, a derogation (explicit consent, vital interests, a legal claim and the like) or the Authority's authorization, and Article 99 has the controller inform the Authority of a rare, non-repetitive transfer. They are conditions on a transfer and require no log or record to be made, kept or produced. The last part of Article 99's list also lets the Authority obtain from the controller or processor any relevant information about transfers made for important public-interest reasons; it is a power to demand information confined to those transfers and names no record, so it is coded as an on-request check by the regulator. No scope clause is cited.
- Kind
- None
- As of
What this law does
Article 97 lets personal data be transferred abroad where the destination country, territory, or international organisation has an adequate level of protection, and it deems every European Union member state adequate on that basis alone.
Article 98 lets a transfer to a country without an adequacy finding proceed instead under an appropriate safeguard, an executory international commitment, Authority approved standard clauses, Authority approved binding corporate rules, an approved certification mechanism, or an approved code of conduct.
Article 99 lets a transfer proceed absent both an adequacy finding and a safeguard where the person has given informed explicit consent, or under a separate list, the safeguarding of vital interests, an important public interest ground, a legal claim, a public register, or contract necessity, and lets a rare, non repetitive transfer touching a limited number of people proceed on the controller's own compelling legitimate interests once the Authority is told.
Article 100 lets the Authority itself authorise a transfer resting on specific contractual clauses or particular safeguards, and its silence for two months, renewable once, counts as a refusal. Article 101 refuses to recognise or enforce a foreign court's or authority's order compelling a transfer or a disclosure out of Monaco unless an international agreement between that state and Monaco provides for it.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .