MaliLoi n° 2013-015, transfer of personal data abroad
Loi n° 2013-015, art. 11 (transfer of personal data abroad)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before transferring personal data to a foreign country, confirm that the Autorité de Protection des Données à Caractère Personnel has found the destination State's own legislation or international commitments provide a sufficient level of protection that is actually applied, or obtain an Autorité decision that the transfer and the recipient's processing, including through contractual clauses or internal rules, guarantee a sufficient level of protection for privacy and fundamental rights and freedoms.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 11 lets a controller transfer personal data to a foreign State where the Autorité has found the recipient State's protection sufficient, or by decision of the Autorité where the transfer and the recipient's processing guarantee sufficient protection. The finding and the decision are the Autorité's own acts; the article requires the controller to keep no log, register or record and names no review.
- Kind
- None
- As of
What this law does
Article 11 lets a controller transfer personal data to a foreign State only where the Autorité de Protection des Données à Caractère Personnel has found that the destination State ensures a sufficient level of protection for persons, whether because of its own internal legislation or commitments made at the international level, and that those measures are actually applied, or where the Autorité has decided that the transfer and the recipient's processing of the data guarantee a sufficient level of protection for privacy and for persons' fundamental freedoms and rights, including because of contractual clauses or internal rules the recipient is subject to.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .