Loi N° 2008-12 du 25 janvier 2008 portant sur la protection des données à caractère personnel (Senegal Personal Data Protection Act 2008)

Law No. 2008-12 of 25 January 2008 is Senegal's primary personal data protection statute and one of the earlier comprehensive data protection laws in West Africa. Enacted on the model of the ECOWAS regional framework and drawing on Council of Europe Convention 108 and the French data protection tradition, the law creates a full regime governing the collection, processing, storage, and transmission of personal data by public and private actors. The law applies to all automated processing of personal data and to non-automated processing in structured filing systems. It covers processing by controllers established in Senegal, and extends to processing by controllers outside the country where they use equipment located in Senegalese territory. Processing for purely personal or domestic purposes is excluded from scope. Core data quality principles are central to the law: data must be collected for specified, explicit and legitimate purposes and not processed in an incompatible manner; must be adequate, relevant and not excessive relative to those purposes; must be accurate and kept up to date; and must not be kept for longer than necessary. Controllers are required to implement appropriate technical and organisational security measures. The law operates a mandatory prior declaration and authorisation regime. All processing of personal data must be declared to the Commission de Protection des Données Personnelles (CDP) before commencing, and the CDP issues a receipt within one month that authorises the processing subject to the controller's full legal responsibilities. Processing involving sensitive data, biometrics, or data relating to criminal offences or national security requires prior authorisation rather than simple declaration. Data subjects are granted rights of access, rectification, erasure, and opposition. The right of access allows a data subject to obtain, free of charge, a copy of the personal data held about them and information about the processing. Automated individual decision-making producing significant legal effects requires specific safeguards. Cross-border transfers of personal data are prohibited unless the recipient country ensures an adequate level of protection, or specific derogations apply including data subject consent or contractual safeguards. The CDP must be notified of or must authorise transfers depending on the circumstances. The CDP is the independent supervisory authority. It is empowered to receive declarations and authorisations, conduct on-site investigations, issue warnings and injunctions, and refer matters for criminal prosecution. Penalties include fines and imprisonment, with aggravated sanctions for unauthorised processing of sensitive data. Source language: French.

1. 1All personal data processing must be declared to the CDP before commencing; the CDP issues a receipt within one month authorising processing without relieving the controller of legal responsibility.
2. 2Processing involving sensitive data, biometrics, criminal offences, or national security data requires prior CDP authorisation rather than a simple declaration.
3. 3Data subjects have rights of access, rectification, erasure, and opposition, including opposition to direct marketing processing without giving reasons.
4. 4Cross-border transfers are prohibited unless the recipient country ensures adequate protection or specific derogations or safeguards apply; CDP notification or authorisation may be required.
5. 5Automated individual decision-making producing significant legal effects requires specific safeguards and data subject notification.
6. 6The CDP investigates complaints, conducts on-site inspections, issues injunctions, and refers matters for criminal prosecution.
7. 7Criminal sanctions include fines and imprisonment; aggravated penalties apply for unauthorised processing of sensitive data.
8. 8Sensitive data categories (health, ethnic origin, political opinions, religious beliefs, sexual life, biometrics, criminal records) are subject to heightened processing conditions.