NicaraguaLey No. 787, Ley de Protección de Datos Personales, cross border transfer of data
Ley No. 787, arts. 14-15 (cross border transfer of data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Publisher's page: http://legislacion.asamblea.gob.ni/normaweb.nsf/9e314815a08d4a6206257265005d21f9/e5d37e9b4827fc06062579ed0076ce1dIn force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before transferring personal data outside Nicaragua, confirm the receiving country or organization provides an adequate level of security and protection, or that the transfer fits one of the law's listed exceptions, such as international judicial cooperation, a health data exchange for epidemiological investigation, a banking or securities transfer, a ratified treaty commitment, or intelligence cooperation against organized crime or drug trafficking.
- Before making the transfer, verify that both you and the recipient meet the applicable security and confidentiality measures, inform the data subject of the request and its purpose for their consent, prevent the data from reaching a third party, and notify the Direccion de Proteccion de Datos Personales of the transfer you made.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 14 bars transfers to countries or international bodies without adequate protection, with listed exceptions, and article 15 sets the procedure for any transfer, ending with the duty in 15(f) to inform the authority of the transfer made. A request stating its object and purpose (15(b)) is the requester's document. No clause tells the controller to keep a log or register of transfers. The row cites no scope clause, so no territorial hook is listed.
- Kind
- None
- As of
What this law does
Article 14 prohibits assigning or transferring personal data of any kind to a country or international organization that does not provide adequate levels of security and protection.
The prohibition does not apply to international judicial cooperation, an exchange of health data necessary for an epidemiological investigation, a banking or securities transfer under its own governing law, a transfer agreed under an international treaty Nicaragua has ratified, or international intelligence cooperation against organized crime, drug trafficking and controlled substances offences, offences against state security, or offences against the international order, each as defined in the laws the article names.
Article 15 requires the data controller, before transferring personal data, to act only on a legally authorized requester's petition stating its object and purpose, to verify that both parties meet the applicable security and confidentiality measures, to inform the data subject of the request and its purpose for their consent subject to article 14's exceptions, to prevent the information from reaching a third party, and to notify the Direccion de Proteccion de Datos Personales of the transfer made.
When LexLint raises it
When your app profile says your app provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .