Senegal Law on Personal Data Protection (Law No. 2008-12)
Senegal's Law No. 2008-12 on the Protection of Personal Data (2008) establishes a comprehensive data protection framework, making Senegal one of the first West African countries with dedicated data protection legislation. The Commission de Protection des Données Personnelles (CDP) oversees compliance. The law establishes processing principles, consent requirements, registration obligations, and individual rights. Aligned with the ECOWAS framework.
Senegal Law on Personal Data Protection (Law No. 2008-12) is a compliance framework from Senegal with 14 domains and 26 controls. The largest domains are Governance, Records and Supervision (4 controls), Security and Processors (3 controls), Transparency and Data Subject Rights (3 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (14)
Breach
| Code | Title |
|---|---|
| SENEGAL-6 | Breach and Enforcement |
Consent
| Code | Title |
|---|---|
| SENEGAL-2 | Consent, Notice, Sensitive Data |
Governance
| Code | Title |
|---|---|
| SENEGAL-5 | CDP Notification, DPO, Governance |
Governance, Records and Supervision
| Code | Title |
|---|---|
| SN-DPL-11.1 | Personal Data Correspondent Function |
| SN-DPL-12.1 | Records of Processing |
| SN-DPL-14.1 | Cooperation with CDP Investigations |
| SN-DPL-15.1 | Sanctions and Penalties Awareness |
Lawful Basis and Consent
| Code | Title |
|---|---|
| SN-DPL-3.1 | Lawful Basis for Processing |
| SN-DPL-3.2 | Consent Requirements |
Marketing and Automated Decisions
| Code | Title |
|---|---|
| SN-DPL-10.1 | Direct Marketing Restrictions |
| SN-DPL-13.1 | Automated Decision Making |
Retention and Cross Border Transfers
| Code | Title |
|---|---|
| SN-DPL-8.1 | Cross-Border Transfer Restrictions |
| SN-DPL-9.1 | Data Retention Limits |
Rights
| Code | Title |
|---|---|
| SENEGAL-3 | Data Subject Rights |
Scope
| Code | Title |
|---|---|
| SENEGAL-1 | Scope, Lawful Basis (Senegal Law 2008-12) |
Scope and Registration with the CDP
| Code | Title |
|---|---|
| SN-DPL-1.1 | Scope and Application |
| SN-DPL-2.1 | CDP Registration of Processing |
Security
| Code | Title |
|---|---|
| SENEGAL-4 | Security and Cross-Border |
Security and Processors
| Code | Title |
|---|---|
| SN-DPL-17.1 | Data Breach Awareness and Response |
| SN-DPL-7.1 | Data Security Measures |
| SN-DPL-7.2 | Confidentiality of Processors |
Sensitive and Health Data
| Code | Title |
|---|---|
| SN-DPL-16.1 | Health Data Specific Rules |
| SN-DPL-6.1 | Sensitive Data Processing |
Transparency and Data Subject Rights
| Code | Title |
|---|---|
| SN-DPL-4.1 | Information to Data Subjects |
| SN-DPL-5.1 | Data Subject Rights |
| SN-DPL-5.2 | Right of Access |
What is Senegal Law on Personal Data Protection (Law No. 2008-12) and who does it apply to?
Senegal Law on Personal Data Protection (Law No. 2008-12) is a compliance framework from Senegal with 14 domains and 26 controls. Senegal's Law No. 2008-12 on the Protection of Personal Data (2008) establishes a comprehensive data protection framework, making Senegal one of the first West African countries with dedicated data protection legislation. The Commission de Protection des Données Personnelles (CDP) oversees compliance. The law establishes processing principles, consent requirements, registration obligations, and individual rights. Aligned with the ECOWAS framework. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Senegal Law on Personal Data Protection (Law No. 2008-12) actually require?
Senegal Law on Personal Data Protection (Law No. 2008-12) has 26 controls organised across 14 domains. The largest domains are Governance, Records and Supervision (4 controls), Security and Processors (3 controls), Transparency and Data Subject Rights (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Senegal Law on Personal Data Protection (Law No. 2008-12) do I already cover?
Senegal Law on Personal Data Protection (Law No. 2008-12) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Senegal Law on Personal Data Protection (Law No. 2008-12)?
Start your Senegal Law on Personal Data Protection (Law No. 2008-12) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Senegal Law on Personal Data Protection (Law No. 2008-12) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 26 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required