SenegalLoi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, transferts vers un pays tiers
Loi n° 2008-12 du 25 janvier 2008, arts. 49-51 (transferts vers un pays tiers)
In force.
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Transfer personal data to a third country only if it ensures a sufficient level of protection for privacy and fundamental rights, unless a narrow consent-based or necessity derogation applies, and tell the CDP before every transfer to a third country.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkGV.PO-P5
- Where the destination country does not offer that level of protection and no derogation applies, get the CDP's authorization for the transfer on a motivated request backed by guarantees sufficient to protect the person's privacy and rights.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 49 allows transfers to a third country only if it ensures an adequate level of protection and requires the controller to inform the Commission before any transfer; Article 50 lists the derogations for one-off, non-massive transfers; Article 51 lets the Commission authorize a transfer on a reasoned request. A prior notice to the Commission and an authorization are filings and not a record the controller keeps. None of the cited articles requires a log or register of transfers, and none carries a scope clause.
- Kind
- None
- As of
What this law does
Article 49 bars transferring personal data to a country that does not ensure a sufficient level of protection for privacy and fundamental rights and freedoms, and requires the controller to notify the CDP before any transfer to a third country.
Article 49 also requires the CDP, before any processing of data coming from abroad, to verify that the controller ensures a sufficient level of protection, judged by the security measures applied, the processing's characteristics, and the nature, origin and destination of the data.
Article 50 lets a controller transfer data to a country that does not meet that standard where the transfer is a one off, non massive transfer made with the person's express consent, or is necessary to protect the person's life, the public interest, a legal claim, or a contract.
Article 51 lets the CDP authorize a transfer or set of transfers to an inadequate country on a duly motivated request where the controller offers sufficient guarantees for privacy, fundamental rights and freedoms, and the exercise of the corresponding rights. Loi n° 2008-12 was promulgated on . It was published in Journal officiel n° 6406 of . The law's final articles state no day of its own for its entry into force.
Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory. Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .