Côte d'Ivoire

Côte d'Ivoire regulates personal data through Law No. 2013-450 of 19 June 2013, enacted to implement the ECOWAS Supplementary Act of 2010. The law applies to automated processing and structured manual files where the controller is established in Côte d'Ivoire or uses equipment located there, excluding purely personal or household processing. Implementing Décret n° 2015-79 of 4 February 2015, now recorded as a separate Instrument in the Library, sets out detailed procedures for notifications and authorisations. Controllers are subject to a prior notification or authorisation regime: ordinary processing is notified, while sensitive data, biometrics, or national identification numbers require prior authorisation. Core data-quality principles apply, and controllers must designate a data protection correspondent in specified circumstances. Data subjects are entitled to intelligible information about processing, to object on legitimate grounds, to refuse direct marketing without reasons, to correct or erase inaccurate data, and not to be subject to solely automated decisions with significant or adverse effects. Cross-border transfers are prohibited unless the recipient country offers adequate protection or derogations apply; the regulator may authorise transfers under appropriate safeguards. Criminal sanctions apply, elevated for violations involving sensitive data or national identification numbers, with carve-outs for national security, criminal investigation, journalism, research, and statistics. A distinctive institutional feature is that enforcement is housed in the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI), the telecoms regulator designated as the data protection authority, which exercises regulatory, investigatory, and sanctioning powers, conducts inspections, and refers matters for prosecution. With an in-force law, a documented implementing decree, and a named operational regulator, Côte d'Ivoire is now a multi-instrument jurisdiction, though data protection supervision sits within the telecoms regulator rather than a dedicated body.