Sao Tome and PrincipeLei n.º 03/2016, transfer of personal data abroad
Lei n.º 03/2016, arts. 19-20 (transfer of personal data abroad)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www.nadpa-rapdp.org/sites/default/files/2020-11/Law_3_2016_protection_of_personal_data.pdfIn force.
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before transferring personal data outside Sao Tome and Principe, confirm the destination legal order offers an adequate level of protection or rely on a stated derogation, and notify NAPPD of a transfer that relies on one.
- Assess the adequacy of the destination legal order's protection in light of the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law, professional rules and security measures in force there, since NAPPD alone decides whether that order meets the standard.
- Where the destination legal order does not ensure an adequate level of protection, transfer personal data only with the holder's unequivocal authorization, under one of the Law's listed derogations (contract necessity, an important public interest or judicial defense, the holder's vital interests, or a public register open to consultation), or with NAPPD's authorization based on sufficient contractual safeguards.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 19 and 20 require an adequacy finding or a listed derogation before a transfer abroad and a notification to the National Agency for a derogation transfer. A notification is a filing with the authority and not a record the controller keeps; neither article requires a log, a record of the adequacy assessment, an audit or a retention period, and neither contains a territorial scope clause.
- Kind
- None
- As of
What this law does
Article 19 permits transferring personal data outside Sao Tome and Principe only under this Law and only where the destination legal order ensures an adequate level of protection, assessed against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law, professional rules and security measures in force there, with NAPPD alone deciding whether a legal order meets that standard.
Article 20 lets a transfer to a legal order without adequate protection proceed, on notice to NAPPD, where the holder has unequivocally authorized it or under a listed derogation: contract necessity involving the holder, an important public interest or a judicial right to declare, exercise or defend, the holder's vital interests, or a public register open to consultation; NAPPD may also authorize such a transfer where the controller shows sufficient contractual safeguards for privacy and fundamental rights. Article 47 defers the Law's own entry into force to general law without stating a day.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .