Data Protection Act, 2011, transfer of personal information outside Lesotho

Data Protection Act, 2011, s. 52 (transfer outside Lesotho)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 22 February 2012.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before transferring personal information about a data subject to a third party in a foreign country, confirm the recipient is subject to a law, code of conduct, or contract that effectively upholds processing principles substantially similar to this Act's, including onward-transfer protections, or rely on another listed condition.
Obtain the data subject's consent to the transfer where you do not rely on the recipient's equivalent legal protection.
Where the transfer is necessary for performance of a contract between you and the data subject, or a contract concluded in the data subject's interest with a third party, you may transfer without separately meeting the equivalent-protection condition.
Where the transfer is for the data subject's benefit and it is not reasonably practicable to obtain consent, confirm the data subject would likely consent if asked before proceeding.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 52 bars a data controller in Lesotho from transferring personal information about a data subject to a third party in a foreign country unless the recipient is subject to a law, code of conduct or contract that effectively upholds processing principles substantially similar to the Act's, including onward-transfer protections.

The prohibition also does not apply where the data subject consents to the transfer, where the transfer is necessary for the performance of a contract between the data subject and the controller or for pre-contractual measures the data subject requested, or where the transfer is necessary for a contract concluded in the data subject's interest between the controller and a third party.

The prohibition additionally does not apply where the transfer is for the data subject's benefit and it is not reasonably practicable to obtain the data subject's consent, or where it would be reasonably practicable and the data subject would likely give it.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

Data Protection Act, 2011 (Act No. 5 of 2012), official text reproduced by LesLII, read through an Internet Archive capture

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://lesotholii.org/akn/ls/act/2012/5/eng@2012-02-22

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app