Personal Data Protection Law, cross-border transfer of personal data

Article 31 requires the CIL's prior authorization before any transfer of personal data to a foreign country.

Article 42 bars a controller from transferring personal data to a foreign country or an international organization unless that country or organization assures a level of protection adequate to the protection Burkina Faso itself assures for privacy and fundamental rights and freedoms, and requires the controller, before any external transfer, to obtain the CIL's authorization, sign a data confidentiality and reversibility clause with the receiving party to let data migrate back fully at the end of the contract, and put in place technical and organizational security measures covering encryption, availability, confidentiality, integrity and resilience.

Article 43 assesses the adequacy of a destination's protection against the nature of the data, the purpose and duration of the processing, the countries of origin and final destination, the general and sectoral legal rules in force there, and the professional rules and security measures observed, and lets that adequacy also rest on an international convention Burkina Faso has joined or on ad hoc or standardized safeguards the CIL has approved, which the CIL can withdraw if exceptional circumstances in the destination country raise a risk of unauthorized access by local authorities.

Article 44 lets a transfer to a country without an adequate level of protection proceed only under a listed exception, including the data subject's specific, free, informed and unambiguous consent given after being told of the risks, contractual necessity, a vital interest, an exceptional-circumstances decree taken after the CIL's concurring opinion, an overriding legitimate interest the law provides for, a one-off and non-massive transfer necessary for an important public interest or a legal claim, a one-off transfer from a public register open to consultation, judicial mutual assistance, a bilateral or multilateral agreement Burkina Faso has joined, or the CIL's express and reasoned authorization of a contract carrying adequate contractual clauses or internal rules.