Transfer of personal data to another country is prohibited unless the receiving country provides sufficient protection for the Data Subject’s private life, liberties and fundamental rights.

Countries members of  the African Associations of data protection (Association Francophone des Autorités de Protection des Données Personnelles) are considered to have sufficient protection for the Data Subject’s private life, liberties and fundamental rights. Other countries are assessed on case-by-case basis and on criteria including the existence of data protection law and authority responsible of data protection.

A transfer to a country not offering a sufficient level of protection is possible if the transfer is timely and non-massive, if the Data Subject agrees to it or if the transfer is necessary to: 

• Protect the life of the Data Subjects/Holders;
• Protect the public interest;
• Comply with obligations allowing the acknowledgment, exercise, or defence of a legal right in court; and
• Perform an agreement between the Data Subject and the Data Processor or take precontractual measures upon the request of the Data Subject. 

In any case, prior transferring personal data, the Data controller must inform the CDP. The information must include: 

• The name and address of the data sender
• The name and address of the data recipient
• The full data file and description
• The type of personal data transferred
• The number of persons concerned
• The data processing purpose
• The transfer method and frequency
• The first transfer date 

(Articles 49-51 of the Act)