Senegal

Senegal was one of West Africa's data protection pioneers. Its primary instrument, Law No. 2008-12 of 25 January 2008 on the protection of personal data, predates the ECOWAS Supplementary Act and drew on Convention 108 and the French data protection tradition. The law governs automated processing and non-automated processing in structured filing systems, covering controllers established in Senegal and those outside the country that use equipment located in Senegalese territory; purely personal or domestic processing is excluded. Core data-quality principles, purpose limitation, adequacy, accuracy, and storage limitation, anchor the regime, and controllers must implement appropriate technical and organisational security measures. A defining feature is the mandatory prior declaration and authorisation regime. All processing must be declared to the Commission de Protection des Données Personnelles (CDP) before it begins; the CDP issues a receipt within one month authorising the processing without relieving the controller of its legal responsibilities. Processing involving sensitive data, biometrics, or data relating to criminal offences or national security requires prior authorisation rather than simple declaration. Data subjects hold rights of access, rectification, erasure, and opposition (including to direct marketing without giving reasons), and automated decisions producing significant legal effects attract specific safeguards. Cross-border transfers are prohibited unless the recipient country ensures adequate protection or derogations and safeguards apply. The CDP, created by the 2008 law, is an established and active independent supervisory authority that receives declarations and authorisations, conducts on-site investigations, issues warnings and injunctions, and refers matters for criminal prosecution; penalties include fines and imprisonment, with aggravated sanctions for unauthorised sensitive-data processing. Having legislated in 2008, earlier than most ECOWAS states, and maintained a continuously operating regulator, Senegal is one of the more established regimes in West Africa, even though its declaration-based architecture reflects the pre-GDPR generation of laws.