Loi N° 2017-020 du 22 juillet 2017 sur la protection des données à caractère personnel (Mauritania Personal Data Protection Act 2017)

Law No. 2017-020 of 22 July 2017 is the Islamic Republic of Mauritania's primary personal data protection statute. Adopted on the model of the ECOWAS regional framework and influenced by Council of Europe Convention 108, the law establishes a comprehensive legal regime for the protection of personal data processed in Mauritania. The law applies to all automated processing of personal data and to non-automated processing in structured filing systems. It covers processing by controllers established in Mauritania, and extends to processing by controllers outside the country where they use equipment or resources in Mauritanian territory. Core data quality principles govern all processing: data must be collected for specified, explicit and legitimate purposes; must be adequate, relevant and not excessive; must be accurate and kept up to date; and must not be retained longer than necessary. Controllers are required to implement appropriate technical and organisational security measures. The law operates a prior notification and authorisation regime. Simple processing activities are declared to the supervisory authority before commencing; processing involving sensitive data requires prior authorisation. Sensitive categories include health information, racial or ethnic origin, political opinions, religious beliefs, trade union membership, and sexual life. Data subjects are granted rights of access, rectification, erasure, and opposition. The right of access entitles data subjects to obtain information about the processing of their personal data in an accessible and intelligible form, including information about the controller's identity, the purposes of processing, the categories of data concerned, and the recipients of the data. Cross-border transfers of personal data are restricted. Transfers to countries not ensuring an adequate level of protection are prohibited unless specific conditions are met, including data subject consent or the use of contractual safeguards approved by the supervisory authority. The supervisory authority is the Autorité de Protection des Données (APD), which has confirmed operational status through bilateral cooperation activities, including a Memorandum of Understanding signed with Algeria's ANPDP in October 2024. Criminal penalties apply for infringements, including fines and imprisonment for processing without required authorisation and for breaches of data security obligations. Note: some secondary sources indicate that the law's implementation may have been phased or that certain provisions required implementing regulations; commencement details and the status of any implementing instruments are flagged for reviewer verification. Source language: French.

1. 1Processing must be declared to or authorised by the APD before commencing, depending on the nature of the data and the processing activity; sensitive data requires prior authorisation.
2. 2Data subjects have rights of access, rectification, erasure, and opposition, including the right to receive information in an accessible and intelligible form.
3. 3Sensitive data (health, racial origin, political opinions, religious beliefs, sexual life) may only be processed with prior APD authorisation.
4. 4Cross-border transfers are prohibited unless the recipient country ensures adequate protection or specific safeguards or derogations apply.
5. 5The APD is the competent supervisory authority under the law; it is operationally confirmed by international cooperation activities as of 2024.
6. 6Criminal penalties apply for processing without required authorisation, breach of security obligations, and obstruction of APD investigations.
7. 7Reviewer note: confirm commencement date and status of any implementing regulations; confirm whether amendments have been enacted since 2017.