SyriaLaw No. 12 of 2024 on Protection of Electronic Personal Data, cross border transfer
Law No. 12 of 2024, arts. 15-16 (cross-border transfer of personal data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://moct.gov.sy/news-0171In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Licensing
- Audit expectation
- none
What it requires
- Obtain the Authority's license and verify that the destination Arab or foreign state offers an acceptable level of protection before transferring, storing abroad, or sharing personal data with a party there.
- Where the destination state lacks a verified protection level, transfer personal data only with the data subject's or their representative's explicit consent and only for one of the purposes article 15(b) lists, such as preserving the data subject's life, defending a legal right, or performing a contract for their benefit.
- Obtain the Authority's license before making personal data available to another controller or processor outside Syria, and confirm that its legal and technical protection level meets the level set in the law's executive instructions.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 15 and 16 bar a transfer abroad unless the Authority has verified an acceptable level of protection and licensed it, or the data subject consents explicitly and a listed purpose applies. They are licensing and consent conditions and require no log, record, audit or retention period. The cited articles state no territorial scope clause.
- Kind
- None
- As of
What this law does
Article 15(a) prohibits transferring, preparing to process, storing or sharing personal data with an Arab or foreign state unless the Authority has verified an acceptable level of protection there and licensed the transfer.
Article 15(b) lets a transfer proceed with the data subject's or their representative's explicit consent, even to a state lacking that verified protection level, only to preserve the data subject's life or provide medical care, to establish or defend a legal right before a competent judicial body, to conclude or perform a contract for the data subject's benefit, to carry out a judicial cooperation procedure, to meet a legal obligation protecting the public interest, or to perform a bilateral or multilateral international agreement Syria has joined.
Article 16 lets a controller or processor make personal data available to another controller or processor outside Syria, with the Authority's license, only where the nature of their work or the purpose for which they hold the data agree, both sides have a legitimate interest in the data, and the foreign controller's or processor's legal and technical protection is not below the level the law's executive instructions set.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .