San MarinoSan Marino Law No. 171, transfers of personal data abroad
Legge 21 dicembre 2018 n. 171, articoli 45-50 (trasferimenti verso paesi terzi)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Rely on an EU adequacy decision, a bilateral treaty, an appropriate safeguard such as binding corporate rules or standard clauses, or a narrow derogation before transferring personal data of a person in San Marino outside the country, under Articles 45 to 50.
- Apply the same conditions to an onward transfer from the destination country or organisation to another one, not only to the first transfer out.
- Where you rely on a derogation in article 50 instead, use one the article lists, and where that is the data subject's explicit consent, inform them of the possible risks of the transfer first.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 50(4) requires a controller or processor that transfers abroad on the compelling-legitimate-interests derogation of Article 50(2) to attest, in the register of processing activities kept under Article 31, the assessment it made and the safeguards it supplied. The recorded items are outside the closed list of log contents. Article 48(2)(l) requires binding corporate rules to provide group mechanisms that verify compliance, including data protection audits, with the results sent to the data protection officer and the parent's administrative body and available to the Autorità Garante on request; this applies only to a group that uses binding corporate rules and fixes no cadence. The Authority's power to ask for the register itself is in Article 31(4), which this row does not cite. The cited articles carry no scope clause.
- Kind
- Explicit
- As of
- Provision
- Article 50, comma 4 (the assessment and safeguards behind a compelling-interests transfer are recorded in the Article 31 register), with Article 48, comma 2, letter l (audits under binding corporate rules)
- Trigger
- personal_data_processing
What this law does
Article 45 permits a transfer of personal data to a foreign country or an international organisation only on the conditions this Title lays down, including for onward transfers from there to another country or organisation.
Article 46 governs transfer on the basis of a decision that the destination affords an adequate level of protection, article 47 transfer subject to appropriate safeguards such as standard data protection clauses, article 48 binding corporate rules and what they must specify, and article 49 the recognition of judgements and decisions of foreign countries.
Article 50 sets the narrow derogations that permit a transfer in the absence of an adequacy decision or appropriate safeguards, including the data subject's explicit consent after being informed of the risks, contractual necessity, important reasons of public interest, legal claims, vital interests, and a transfer from a public register.
Law 171/2018 was approved by the Great and General Council on and promulgated by the Captains Regent on , the date carried in the law's own official title. Article 129 provides that the law enters into force on the fifteenth day after its legal publication. The Bollettino Ufficiale records its publication on , so the law entered into force on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .