Personal Data Protection Law, sensitive personal data categories

Loi n°001-2021/AN, arts. 5, 12, 30-31, 35 (données sensibles)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 30 March 2021.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Obtain the data subject's express consent before collecting or processing sensitive personal data, including data about health, biometric or genetic characteristics, sex life, racial or ethnic origin, political, philosophical, religious or trade union opinions or activity, morals, or criminal investigations, prosecutions, convictions and administrative or safety measures, unless a specific statutory exception applies.
Obtain a Commission de l'informatique et des libertés (CIL) authorization before processing genetic or biometric data in the private sector, including for health research, and before processing personal data about offenses, convictions or safety measures in the private sector.
Restrict any processing of personal data about offenses, convictions or safety measures to a court or public authority acting within its legal powers, a public body managing a public service after the CIL's concurring opinion, or a legal auxiliary acting strictly within duties assigned to it.

What it reaches

Obligation class

Consent, Prohibition, Biometric

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 5 defines sensitive personal data (données sensibles) to include health, biometric and genetic data, sexual life, racial or ethnic origin, political, philosophical or religious opinions or activities, trade union membership, morals, and data about criminal investigations, prosecutions, convictions, and administrative or safety measures.

Article 12 bars collecting or processing that data without the data subject's express consent, subject to a statutory exception, and lets a separate law bar such processing even where the data subject consents.

Article 30 requires a legislative or regulatory act, taken after the CIL's opinion, before a public body, a public establishment, a territorial authority, or a private entity managing a public service processes sensitive personal data under that fourth category, on top of the same requirement for state security, criminal justice, or census processing.

Article 31 requires the CIL's prior authorization before the private sector processes genetic or biometric data, including for health research, before it processes data about offenses, convictions or safety measures, and before it processes biometric data specifically.

Article 35 restricts who may process personal data about offenses, convictions and safety measures to courts and public authorities acting within their legal powers, a public body managing a public service after the CIL's concurring opinion, and legal auxiliaries strictly for the duties assigned to them.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice
handles_health_records

Read the law

Loi n°001-2021/AN, official text as published by the Assemblée nationale du Burkina Faso on its own storage domain

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app