Lei n.º 03/2016, transfer of personal data abroad

Lei n.º 03/2016, arts. 19-20 (transfer of personal data abroad)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before transferring personal data outside Sao Tome and Principe, confirm the destination legal order offers an adequate level of protection or rely on a stated derogation, and notify NAPPD of a transfer that relies on one.
Assess the adequacy of the destination legal order's protection in light of the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law, professional rules and security measures in force there, since NAPPD alone decides whether that order meets the standard.
Where the destination legal order does not ensure an adequate level of protection, transfer personal data only with the holder's unequivocal authorization, under one of the Law's listed derogations (contract necessity, an important public interest or judicial defense, the holder's vital interests, or a public register open to consultation), or with NAPPD's authorization based on sufficient contractual safeguards.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 19 permits transferring personal data outside Sao Tome and Principe only under this Law and only where the destination legal order ensures an adequate level of protection, assessed against the nature of the data, the purpose and duration of the processing, the countries of origin and destination, and the rules of law, professional rules and security measures in force there, with NAPPD alone deciding whether a legal order meets that standard.

Article 20 lets a transfer to a legal order without adequate protection proceed, on notice to NAPPD, where the holder has unequivocally authorized it or under a listed derogation: contract necessity involving the holder, an important public interest or a judicial right to declare, exercise or defend, the holder's vital interests, or a public register open to consultation; NAPPD may also authorize such a transfer where the controller shows sufficient contractual safeguards for privacy and fundamental rights.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

Lei n.º 03/2016 sobre a Protecção de Dados Pessoais, reproduced by the Network of African Data Protection Authorities (NADPA-RAPDP)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www.nadpa-rapdp.org/sites/default/files/2020-11/Law_3_2016_protection_of_personal_data.pdf

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app