Burkina Faso

Burkina Faso regulates personal data through Law No. 001-2021/AN of 30 March 2021, which replaced the earlier Law No. 010-2004/AN and represents a comprehensive modernisation drawing on the GDPR and Convention 108+. The law applies to automated processing and structured manual files by public and private entities, with extra-territorial reach over controllers and processors outside Burkina Faso whose processing relates to data subjects in the country. It expands data-subject rights to include portability, erasure, and restriction alongside access, rectification, and objection, requires records of processing and privacy by design and by default, and introduces a mandatory DPO requirement for large-scale monitoring or large-scale sensitive-data processing. A significant departure from the 2004 regime is mandatory breach notification: controllers must notify the regulator within 72 hours, and affected data subjects without undue delay for high-risk breaches. Cross-border transfers require adequacy, appropriate safeguards (standard contractual clauses or binding corporate rules), or a derogation. Sensitive data requires additional safeguards and prior authorisation. Enforcement rests with the Commission de l'Informatique et des Libertés (CIL), the autonomous authority continued under the 2021 law and historically significant as the first operational francophone sub-Saharan African data protection authority (established 2004, operational from December 2007). The 2021 law enhanced the CIL's arsenal by adding administrative fines to the criminal sanctions retained from the earlier law. With a modern GDPR-aligned statute, a clear legislative history (a superseded 2004 predecessor), and one of the region's longest-running regulators, Burkina Faso is among the more developed and better-documented West African regimes.