Madagascar

Madagascar has a comprehensive standalone data protection statute, Law No. 2014-038 on the protection of personal data, adopted by the National Assembly in December 2014, promulgated on 9 January 2015, and in force on publication in the Official Gazette in June 2015. The law draws on the EU Data Protection Directive 95/46/EC and reflects the principles of the African Union (Malabo) Convention. It applies to automated or manual processing carried out on Malagasy territory by public bodies or private organisations, and reaches processing outside Madagascar where a controller uses means located in the country. Controllers must register with the supervisory commission before processing, and processing must rest on a lawful basis, consent, contractual necessity, legal obligation, vital interests, or public interest. Sensitive categories (health, biometric, political opinion, religious belief, racial origin) attract heightened restrictions and generally require express consent or an authorised derogation. Data subjects have rights to be informed, to access, to rectify, to object (including to direct marketing), and to refuse automated decision-making with significant effects. The law does not prescribe an explicit breach-notification timeline, but inadequate security is an enforceable violation. Cross-border transfers are permitted only to countries with adequate protection or where the commission authorises a transfer on the basis of contractual guarantees, binding corporate rules, or consent. Penalties combine administrative suspension of processing with criminal fines of MGA 200,000 to MGA 10,000,000 and, for serious offences such as unlawful sensitive-data processing, imprisonment. Institutionally, Madagascar's framework was hampered for years by the absence of a functioning regulator. The Commission Malagasy de l'Informatique et des Libertés (CMIL) was only formally constituted by Decree 2023-1541 in December 2023 and operationalised in August 2025; before then, the law's reference to a supervisory body went unrealised, significantly limiting enforcement. With the CMIL now operational, the regime has moved from law-on-paper toward active supervision, though it remains early in that transition.