Niger

Niger has a comprehensive, recently modernised data protection regime. Its current primary instrument is Law No. 2022-59 of 16 December 2022 on the protection of personal data, which replaced the earlier framework established by Law No. 2017-28 of 3 May 2017 (as amended in 2019). The 2022 law reflects alignment with the ECOWAS regional framework and Convention 108+, and applies to any collection, processing, preservation, or use of personal data by automated or manual means in structured filing systems. Personal data is defined broadly to capture any information relating to an identified or identifiable natural person. The law imposes the standard controller obligations, lawfulness, purpose limitation, data minimisation, accuracy, security, and accountability, and grants data subjects rights of access, rectification, erasure, and objection. Sensitive personal data is subject to stricter conditions and may require prior authorisation from the supervisory authority, and cross-border transfers are restricted to countries ensuring an adequate level of protection. The regime has continued to evolve since 2022: it has been further modified by Law No. 2023-31 of 4 July 2023 and by Ordinances Nos. 2024-16 and 2024-29 of 2024, indicating an unusually active legislative pipeline for a Sahelian jurisdiction. Enforcement is carried out by the Haute Autorité de la Protection des Données à Caractère Personnel (HAPDP), the independent supervisory authority first established under the 2017 law and officially launched on 5 August 2020. The HAPDP receives declarations and authorisation requests, investigates complaints, runs public-awareness activities, and enforces compliance, and it has carried over into the 2022 framework. Niger therefore presents a single, current, in-force statute backed by an operational regulator, a relatively well-developed posture, tempered by the fact that the frequent post-2022 modifications make the consolidated current text harder to pin down.