Personal Data Protection Law, rights of the data subject

Loi n°001-2021/AN, arts. 14-22, 31 (droits de la personne concernée)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 30 March 2021.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Obtain a person's prior consent before sending them unsolicited direct marketing communications of any kind, tell them before their data is first used for that purpose or disclosed to a third party, and let them withdraw consent at any time.
Do not base a court decision assessing a person's behavior on an automated processing that profiles them, and do not base an administrative or private decision assessing a person's behavior solely on such automated processing.
Tell a data subject, no later than when you collect their data, your identity, the purposes of the processing, the categories of data, the recipients, the rights of access, rectification, erasure and objection, the retention period, any transfer abroad, and how to give or withdraw consent.
Answer a data subject's access request by letting them consult their data on site or by giving them a copy after they prove their identity, and let a deceased adult's spouse, children or designated heir exercise that right on their behalf, or a minor's parent or legal representative exercise it for the minor, keeping the minor informed for medical data.
Where processing concerns state security, defense, public safety, intelligence, or judicial or administrative police, direct the data subject to the CIL's indirect access procedure rather than answering the request yourself.
Tell a data subject, on request, the information and reasoning behind an automated or non-automated processing decision applied against them, and where the processing relies on artificial intelligence, disclose the criteria and the nature of the personal data behind it from the moment you collect it.
Stop processing a person's data on their objection for legitimate reasons, unless you can show an overriding legitimate ground for the processing that outweighs their rights.
Rectify, complete, update, lock or erase personal data at a data subject's written request within two months, notify any third party the data was disclosed to, and carry the burden of proof if you dispute the request.
Remove, on request, personal data about a person's past private life that was collected and made public on a website, whether or not it is indexed by a search engine.
Obtain a CIL authorization before using an automated decision-support tool that profiles a person or relies on artificial intelligence techniques for predictive purposes in an administrative or private decision.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction, Consent

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 14 bars unsolicited direct marketing addressed to a person who has not given prior consent, and gives every person the right to be informed before their data is first used, disclosed to a third party, or used on a third party's behalf, and to be expressly asked for consent.

Article 15 bars a court decision assessing human behavior from resting on an automated processing that profiles the person, and bars an administrative or private decision assessing human behavior from resting solely on such automated processing.

Article 16 requires the controller to proactively tell the data subject, no later than collection, its identity, the processing's purposes, the categories of data, the recipients, the rights of access, rectification, erasure and objection, the retention period, any transfer abroad, and how to give or withdraw consent, subject to a narrow exception for data collected to establish a state security, defense or public safety offense.

Article 17 gives the data subject a right of access by consultation or copy, lets a deceased adult's spouse, children or a designated heir exercise it unless the deceased objected to posthumous access to medical data, and lets a minor's parent or legal representative exercise it, directly or through a doctor for medical data, while keeping the minor informed.

Article 18 requires the data subject to route a request concerning state security, defense, public safety, intelligence, judicial police or administrative police processing through the CIL's indirect access procedure rather than directly to the controller.

Article 19 gives every person the right to know and contest the information and reasoning behind an automated or non-automated processing decision applied against them, and where the processing relies on artificial intelligence, the right to be told the criteria and the nature of the personal data behind it from the moment of collection. Article 20 gives a person the right to object to processing of their data for legitimate reasons, unless the controller shows an overriding legitimate ground.

Article 21 lets a person demand rectification, completion, updating, locking or erasure of inaccurate, incomplete, ambiguous, outdated or unlawfully processed data, requires the controller to justify compliance within two months and notify any third party the data reached, and puts the burden of proof on the controller if the request is disputed.

Article 22 gives a person a right to be forgotten, letting them obtain removal of personal data about their past private life that was collected and made public on a website, whether or not a search engine indexes it. Article 31 requires the CIL's prior authorization before an administrative or private decision-support tool assesses human behavior, profiles a person, or relies on artificial intelligence techniques for predictive purposes.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content
serves_minors

Read the law

Loi n°001-2021/AN, official text as published by the Assemblée nationale du Burkina Faso on its own storage domain

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app