Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 30 March 2021.
A comprehensive regime rule binding public and private bodies.
As of 4 September 2026.
What it requires
- Obtain the data subject's prior consent before processing their personal data, unless a specific legal exception applies, such as performing a contract, protecting a vital interest, complying with a legal obligation, or a public-interest ground.
- Obtain the data subject's express consent before collecting or processing sensitive personal data, including health, biometric, genetic, sexual-life, ethnic-origin, political, religious, or trade-union data, or criminal-record and sanction data.
- Obtain a Commission de l'informatique et des libertés (CIL) authorization before processing biometric or genetic data in the private sector, before interconnecting files, before processing a national identification number, or before any purely automated profiling used for predictive purposes.
- Do not base a decision that produces legal effects for a person, or otherwise significantly affects them, solely on automated processing, including artificial-intelligence-based processing, that evaluates their profile or personality, and disclose the logic behind such a decision when the person asks.
- Obtain a person's prior consent before sending them unsolicited direct-marketing communications of any kind, inform them before their data is first used for that purpose, and let them withdraw consent at any time.
- Obtain a CIL authorization before transferring personal data outside Burkina Faso, unless the destination country or organization assures a level of protection adequate to Burkina Faso's own, or a specific exception applies, such as the data subject's explicit consent, contractual necessity, a bilateral or multilateral agreement, or CIL-approved standard contractual clauses.
- Respond to a data subject's request to access, rectify, complete, update, lock, or erase their personal data, and pass on any correction to any third party the data was disclosed to.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 79 refers violations of this law to the Penal Code's own provisions on information-technology and communications-technology offenses, rather than stating a criminal amount in this law itself.
Penalty structure
Art. 65 sets the CIL's general forfeitary fine (l'amende forfaitaire) at 1% of the controller's prior-year, tax-exclusive turnover for a first violation, rising to 5% for a repeat violation, proportioned to the gravity of the breach and the advantage gained from it. The same Title IV, Chapter 1 also lists a separate schedule of fixed-range fines the CIL may pronounce for specific enumerated violations (Arts. 67 to 75), running from 1,000,000 to 100,000,000 CFA francs depending on the violation (for example, 5,000,000 to 100,000,000 francs for diverting the purpose of a collection, and 2,000,000 to 5,000,000 francs for processing personal data despite a legitimate objection); the law's own text does not state how that fixed-range schedule relates to the Art. 65 percentage formula.
- Rule
- Turnover pct only
- As of
- 4 September 2026
- Turnover percentage cap
- 5
Who enforces it
Enforcement body
Commission de l'informatique et des libertés (CIL), an independent administrative authority created by the law
What it reaches
Obligation class
Consent, Data subject rights, Biometric, Transfer, Licensing, Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Burkina Faso's comprehensive personal-data statute, adopted by the National Assembly on 30 March 2021 and enforced by the Commission de l'informatique et des libertés (CIL).
It requires a lawful basis, ordinarily the data subject's prior consent, for processing personal data, and express consent for sensitive categories (health, biometric, genetic, sexual-life, ethnic, political, religious, trade-union, and criminal-record data), with CIL authorization required before biometric or genetic data is processed in the private sector, before files are interconnected, before a national identification number is processed, or before purely automated profiling is used for predictive purposes.
It gives data subjects rights to information, access (exercised by a parent or legal guardian on a minor's behalf), rectification, erasure, objection, and an explicit right to be forgotten regarding personal data made public about their past private life, and it bars a legal, administrative, or private decision from resting solely on automated processing, including artificial-intelligence-based processing, that evaluates a person's profile or personality, giving the person a right to know and contest its logic.
It prohibits unsolicited direct-marketing communications absent the recipient's prior consent. A cross-border transfer requires the destination to assure an adequate level of protection, ordinarily confirmed by a prior CIL authorization, subject to narrow derogations. The law does not impose a proactive breach-notification duty on a controller.
Enforcement combines administrative sanctions the CIL can pronounce directly, a private right of action letting a data subject seek damages for the harm suffered, and a cross-reference to the Penal Code's information-technology offense provisions for criminal exposure. The law repealed and replaced Burkina Faso's first data-protection statute, Loi n°010-2004/AN.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometricsserves_minors