The principle in this area is that the transfer of data to a third country is only authorised if that State ensures a level of protection of privacy, freedoms and fundamental rights that is greater than or equivalent to that in force in Côte d'Ivoire (article 26 of Law 2013-450). 

Article 26 also states that prior to any actual transfer of personal data to a third country, the data controller must obtain prior authorisation from ARTCI.

This authorization is required even if the third country is considered to have an adequate level of protection.

The application for authorization must be submitted by a legal entity under Ivorian law (Article 7 of the 2015 Decree).

According to the said Article 7, the authorization application must include several elements, including:

• The identity and address of the data controller and, where applicable, its representative
• The nature of the data involved
• The reason for and purposes of the transfer
• The guarantees of protection, conservation, confidentiality of the data and respect for the rights of the data subjects
• The name of the country hosting the transferred data and the legal framework relating to personal data applicable in that country
• The methods of transmission of the data concerned
• The guarantee of unhindered access to the transferred data by the data subject and by the Ivorian public authorities

According to Article 8 of the Decree, data transfers to third countries are subject to regular monitoring by ARTCI, particularly about their purpose. The ARTCI may set up cooperation mechanisms with the data protection authorities of the main host countries. The data controller must draw up and submit to ARTCI an annual activity report on the transfer of data to third countries.