Digital Code, Book I: cross-border transfer of personal data

Code Numérique, Livre Premier, Arts. 99 à 102 (transferts vers un pays tiers)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 18 September 2025.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not transfer personal data to a country or international organization outside Djibouti unless it offers an adequate level of protection or another authorized safeguard applies.
Apply the same adequacy or safeguard requirement to an onward transfer from the destination country or organisation to a further one, not only to the first transfer out.
Where you rely on an Article 102 exception instead, use one the article lists, and where that is the data subject's consent, obtain it expressly for the specific transfer.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 99 bars a controller or processor from transferring personal data to a country or international organisation outside Djibouti unless that country or organisation ensures a level of protection equivalent and sufficient to Book I's own, and applies the same requirement to an onward transfer from the destination country or organisation to a further one.

Article 100 sets the factors the Commission weighs to determine whether that level of protection is equivalent and sufficient, including the rule of law, the respect for fundamental freedoms and rights, and the legislation, general and sectoral, in force in the destination country or organisation.

Article 101 lets the Commission withdraw a country or organisation from its adequacy list, refuse a declared transfer, or order an existing transfer to that destination to stop, once it finds the destination no longer ensures a sufficient level of protection.

Article 102 lets a controller or processor transfer personal data to a non-adequate third country outside the African Union, or to a non-adequate international organisation, only on the conditions it lists, including the data subject's express consent to the specific transfer, contractual necessity between the controller and the data subject or a third party, and a legally compelling public-interest ground.

The Digital Code, including Book I, was adopted by the National Assembly on 30 June 2025 and signed by the President of the Republic on 6 July 2025. It was published in the Journal Officiel on 18 September 2025, the date these provisions took effect.

When LexLint raises it

crawls_web
trains_models
processes_biometrics

Read the law

Text of Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Premier, reproduced by the Journal Officiel de la République de Djibouti

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app