Senegal Law on Personal Data Protection (Law No. 2008-12)
Senegal's personal data protection law, Law No. 2008-12 of 25 January 2008 with implementing Decree No. 2008-721, supervised by the Commission des Données Personnelles (CDP): prior declaration or authorisation of processing, consent-based lawful processing without a legitimate-interests ground, strict rules on sensitive, health and criminal data, adequacy-based transfers declared to the CDP, access, objection and rectification rights, ten mandatory security measures, and fines of up to 100 million CFA francs. Still in force in 2026; a revision drafted since 2019 has not been enacted.
Senegal Law on Personal Data Protection (Law No. 2008-12) is a compliance framework from Senegal with 8 domains and 32 controls. The largest domains are Processing principles and lawful bases – Senegal Law on Personal Data Protection (Law No. 2008-12) (6 controls), Special categories and specific processing – Senegal Law on Personal Data Protection (Law No. 2008-12) (6 controls), Prior formalities with the CDP – Senegal Law on Personal Data Protection (Law No. 2008-12) (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
Controller obligations: confidentiality, security, retention – Senegal Law on Personal Data Protection (Law No. 2008-12)
| Code | Title |
|---|---|
| senegal-law-on-personal-data-protection-law-no-2008-12::70 | Keep processing confidential, with signed commitments from staff who handle data |
| senegal-law-on-personal-data-protection-law-no-2008-12::71 | Implement the ten Article 71 security measures, including access logging and backups |
| senegal-law-on-personal-data-protection-law-no-2008-12::74 | Keep processed data usable over time whatever the technology |
Prior formalities with the CDP – Senegal Law on Personal Data Protection (Law No. 2008-12)
| Code | Title |
|---|---|
| senegal-law-on-personal-data-protection-law-no-2008-12::17 | Rely on the exemptions from prior formalities only where they strictly apply |
| senegal-law-on-personal-data-protection-law-no-2008-12::18 | Declare ordinary processing to the CDP and wait for the receipt before starting |
| senegal-law-on-personal-data-protection-law-no-2008-12::20 | Obtain CDP authorisation for genetic, health-research, criminal, interconnection, national-ID, biometric and public-interest processing |
| senegal-law-on-personal-data-protection-law-no-2008-12::21 | Adopt State processing on security, crime, census, sensitive data and payroll only by regulatory act after a reasoned CDP opinion |
| senegal-law-on-personal-data-protection-law-no-2008-12::22 | Include the eleven required elements in every filing and update the CDP on changes and closure |
Processing principles and lawful bases – Senegal Law on Personal Data Protection (Law No. 2008-12)
| Code | Title |
|---|---|
| senegal-law-on-personal-data-protection-law-no-2008-12::33 | Process on consent or on one of the four listed necessities |
| senegal-law-on-personal-data-protection-law-no-2008-12::34 | Collect lawfully and fairly for explicit purposes, keep data minimal, accurate and no longer than needed |
| senegal-law-on-personal-data-protection-law-no-2008-12::39 | Use only processors giving sufficient guarantees, under a written contract with security and confidentiality duties |
| senegal-law-on-personal-data-protection-law-no-2008-12::47 | Send direct marketing only to persons who consented in advance |
| senegal-law-on-personal-data-protection-law-no-2008-12::48 | Take no legal decision about a person based solely on automated profiling |
| senegal-law-on-personal-data-protection-law-no-2008-12::61 | Inform users of cookies and similar terminal access and how to refuse, unless strictly necessary |
Rights of data subjects – Senegal Law on Personal Data Protection (Law No. 2008-12)
| Code | Title |
|---|---|
| senegal-law-on-personal-data-protection-law-no-2008-12::58 | Give the Article 58 information at collection, or at recording or first disclosure when collected indirectly |
| senegal-law-on-personal-data-protection-law-no-2008-12::62 | Answer written access requests with confirmation, the data and their origin, purposes, recipients and transfers |
| senegal-law-on-personal-data-protection-law-no-2008-12::67 | Route access to security and defence files through the CDP's designated magistrate member |
| senegal-law-on-personal-data-protection-law-no-2008-12::68 | Offer the right to object on legitimate grounds, asked for at collection |
| senegal-law-on-personal-data-protection-law-no-2008-12::69 | Rectify, complete, lock or delete data on request within one month, free, and notify recipients |
Scope and territorial reach – Senegal Law on Personal Data Protection (Law No. 2008-12)
| Code | Title |
|---|---|
| senegal-law-on-personal-data-protection-law-no-2008-12::2 | Apply the Law to all processing in Senegal and appoint a local representative when using means located there |
Special categories and specific processing – Senegal Law on Personal Data Protection (Law No. 2008-12)
| Code | Title |
|---|---|
| senegal-law-on-personal-data-protection-law-no-2008-12::40 | Process sensitive data only under an Article 41 exception |
| senegal-law-on-personal-data-protection-law-no-2008-12::42 | Restrict criminal-record processing to courts, public authorities and officers of justice |
| senegal-law-on-personal-data-protection-law-no-2008-12::43 | Process health data only on the Article 43 grounds, collected from the patient, under professional secrecy |
| senegal-law-on-personal-data-protection-law-no-2008-12::45 | Apply the journalism, research and artistic exemption only within professional ethics |
| senegal-law-on-personal-data-protection-law-no-2008-12::73 | Certification service providers collect signature data from the holder and use them only for certificates |
| senegal-law-on-personal-data-protection-law-no-2008-12::D37 | Anonymise or code data before passing them on for historical, statistical or scientific use and never publish identifiable results |
Supervision, inspections and sanctions – Senegal Law on Personal Data Protection (Law No. 2008-12)
| Code | Title |
|---|---|
| senegal-law-on-personal-data-protection-law-no-2008-12::16 | Use CDP services: complaints, charter approval, public register and cooperation |
| senegal-law-on-personal-data-protection-law-no-2008-12::25 | Give CDP inspectors access to premises, documents, programs and data |
| senegal-law-on-personal-data-protection-law-no-2008-12::30 | Face warnings, formal notices, withdrawal, fines of 1 to 100 million CFA francs and urgent suspension |
Transfers and interconnection – Senegal Law on Personal Data Protection (Law No. 2008-12)
| Code | Title |
|---|---|
| senegal-law-on-personal-data-protection-law-no-2008-12::49 | Transfer outside Senegal only to countries with sufficient protection, after telling the CDP |
| senegal-law-on-personal-data-protection-law-no-2008-12::51 | Obtain CDP authorisation for transfers to inadequate countries on the strength of sufficient guarantees |
| senegal-law-on-personal-data-protection-law-no-2008-12::53 | Seek authorisation for file interconnections and keep them purpose-bound and non-discriminatory |
What is Senegal Law on Personal Data Protection (Law No. 2008-12) and who does it apply to?
Senegal Law on Personal Data Protection (Law No. 2008-12) is a compliance framework from Senegal with 8 domains and 32 controls. Senegal's personal data protection law, Law No. 2008-12 of 25 January 2008 with implementing Decree No. 2008-721, supervised by the Commission des Données Personnelles (CDP): prior declaration or authorisation of processing, consent-based lawful processing without a legitimate-interests ground, strict rules on sensitive, health and criminal data, adequacy-based transfers declared to the CDP, access, objection and rectification rights, ten mandatory security measures, and fines of up to 100 million CFA francs. Still in force in 2026; a revision drafted since 2019 has not been enacted. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Senegal Law on Personal Data Protection (Law No. 2008-12) actually require?
Senegal Law on Personal Data Protection (Law No. 2008-12) has 32 controls organised across 8 domains. The largest domains are Processing principles and lawful bases – Senegal Law on Personal Data Protection (Law No. 2008-12) (6 controls), Special categories and specific processing – Senegal Law on Personal Data Protection (Law No. 2008-12) (6 controls), Prior formalities with the CDP – Senegal Law on Personal Data Protection (Law No. 2008-12) (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Senegal Law on Personal Data Protection (Law No. 2008-12) do I already cover?
Senegal Law on Personal Data Protection (Law No. 2008-12) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Senegal Law on Personal Data Protection (Law No. 2008-12)?
Start your Senegal Law on Personal Data Protection (Law No. 2008-12) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Senegal Law on Personal Data Protection (Law No. 2008-12) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 32 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required