Loi n° 2017-020, transferts vers un pays tiers

Loi n° 2017-020 du 22 juillet 2017, arts. 20-25 (transferts vers un pays tiers)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 22 July 2017.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not transfer personal data to a country that does not ensure an adequate level of protection unless it appears on the Authority's published list of adequate countries, or a narrow consent-based or public-interest derogation applies.
Before transferring personal data to a country that does not ensure an adequate level of protection, obtain the Personal Data Protection Authority's authorisation on a motivated request, backed by sufficient guarantees such as appropriate contractual clauses.
Before transferring data to a country not on the Authority's published adequacy list, notify the Authority first and follow the conditions and procedural rules it sets.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 20 bars transferring personal data to a country that does not ensure a sufficient level of protection for privacy and fundamental rights and freedoms, and article 21 requires the Authority to publish and keep up to date the list of countries it considers to offer that sufficient level. Article 22 requires the controller to notify the Authority before any transfer to a country not on that list, with the transfer following the conditions and procedural rules the Authority sets.

Article 23 judges the sufficiency of a country's protection by its security measures, and by the processing's purpose, duration, and the nature, origin and destination of the data. Article 24 lets a controller transfer data to a country that does not meet that standard where the transfer is a one off, non massive transfer made with the person's express consent, or is necessary to protect the person's life, the public interest, a legal claim, or a contract.

Article 25 lets the Authority authorize a transfer or set of transfers to an inadequate country on a duly motivated request where the controller offers sufficient guarantees, which may take the form of appropriate contractual clauses.

When LexLint raises it

crawls_web
trains_models
automated_outreach

Read the law

Text of Loi n° 2017-020, published in the Journal Officiel de la République Islamique de Mauritanie, hosted by the ILO's NATLEX database

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app