Loi n° 2019-014, transfert des données vers un pays tiers

Loi n° 2019-014 du 29 octobre 2019, arts. 28-31 (cross border transfer)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before transferring personal data to a third country, confirm that country ensures a sufficient level of protection for privacy and fundamental rights and freedoms, and inform the Instance beforehand for its reasoned opinion.
Where the destination country does not ensure a sufficient level of protection, transfer personal data there only as a one off, non massive transfer with the data subject's express consent, or where the transfer meets one of the law's listed grounds, such as safeguarding the person's life or a contractual necessity.
Where you cannot meet the one off transfer conditions, obtain the Instance's authorization for a transfer or set of transfers to a country lacking adequate protection, by offering sufficient guarantees for privacy, fundamental rights and freedoms and the exercise of the corresponding rights.
Expect the Instance to verify, before any processing of personal data you receive from abroad, that you assure a sufficient level of protection for privacy and fundamental rights, judged by your security measures and the purpose, duration, nature, origin and destination of the data.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 28 permits a transfer of personal data to a third country only if that country ensures a sufficient level of protection for privacy, freedoms and fundamental rights, and requires the controller to inform the Instance beforehand for its reasoned opinion.

Article 29 admits a one off, non massive transfer to a country that does not meet that standard where the data subject has expressly consented, or the transfer is necessary to safeguard the person's life, the public interest, a right in court, or a contract with the person.

Article 30 lets the Instance authorize a transfer or set of transfers to a country lacking adequate protection on a reasoned request, where the controller offers sufficient guarantees for privacy, fundamental rights and freedoms and for the exercise of the corresponding rights.

Article 31 requires the Instance, before any processing of personal data received from abroad, to verify that the controller assures a sufficient level of protection, judged by the security measures applied, the processing's purpose and duration, and the nature, origin and destination of the data.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

Journal Officiel de la République Togolaise
numéro spécial du 29 octobre 2019, cited through an Internet Archive capture of the Ministry of the Digital Economy's PDF (numerique.gouv.tg)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2020. Publisher's page: https://numerique.gouv.tg/wp-content/uploads/2020/01/Loi-n-2019-014-du-29-octobre-2019-relative-a-la-protection-des-donnees-a-caractere-pers…

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app