MauritaniaLoi n° 2017-020, transferts vers un pays tiers
Loi n° 2017-020 du 22 juillet 2017, arts. 20-25 (transferts vers un pays tiers)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Do not transfer personal data to a country that does not ensure an adequate level of protection unless it appears on the Authority's published list of adequate countries, or a narrow consent-based or public-interest derogation applies.
- Before transferring personal data to a country that does not ensure an adequate level of protection, obtain the Personal Data Protection Authority's authorisation on a motivated request, backed by sufficient guarantees such as appropriate contractual clauses.
- Before transferring data to a country not on the Authority's published adequacy list, notify the Authority first and follow the conditions and procedural rules it sets.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 20 to 25 bar a transfer to a country without a sufficient level of protection, have the Authority publish the list of sufficient countries (article 21), require the controller to inform the Authority before a transfer to a country not on that list and to follow the conditions it sets (article 22), set how sufficiency is judged (article 23), allow one-off transfers on listed grounds (article 24), and let the Authority authorize a transfer on sufficient guarantees (article 25). The prior notice to the Authority is a notification and the authorization is a filing; neither requires the controller to keep, make or produce a log or record of its transfers.
- Kind
- None
- As of
What this law does
Article 20 bars transferring personal data to a country that does not ensure a sufficient level of protection for privacy and fundamental rights and freedoms, and article 21 requires the Authority to publish and keep up to date the list of countries it considers to offer that sufficient level. Article 22 requires the controller to notify the Authority before any transfer to a country not on that list, with the transfer following the conditions and procedural rules the Authority sets.
Article 23 judges the sufficiency of a country's protection by its security measures, and by the processing's purpose, duration, and the nature, origin and destination of the data. Article 24 lets a controller transfer data to a country that does not meet that standard where the transfer is a one off, non massive transfer made with the person's express consent, or is necessary to protect the person's life, the public interest, a legal claim, or a contract.
Article 25 lets the Authority authorize a transfer or set of transfers to an inadequate country on a duly motivated request where the controller offers sufficient guarantees, which may take the form of appropriate contractual clauses.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .