Loi n° 24.001 portant protection des données à caractère personnel, sanctions et agence

Loi n° 24.001, Chapitre VIII et Chapitre IX (sanctions et agence)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

An enforcement supervision rule binding public and private bodies.

As of 19 September 2026.

What it requires

Comply with an administrative sanction the agency imposes for a breach of the Act, a warning, an order to stop processing, a pecuniary sanction of up to 5 percent of your turnover, or withdrawal of an authorization or certification, doubled on repeat conduct.
Expect the agency to order an urgent interruption of your processing for up to three months, or to lock the data concerned for up to three months where the processing serves State security, defense, or public safety, whenever it violates the rights and freedoms the Act protects, and expect it to seek a court order under an emergency referral for a grave and immediate breach.
Respond to the agency's report before any sanction, in writing or orally and represented if you choose, and expect a reasoned, published decision you may appeal to the administrative courts, at your cost if you are sanctioned.
Expect criminal liability, from six months to five years' imprisonment and a fine of 100,000 to 10,000,000 FCFA depending on the offence, for obstructing the agency, negligent processing without required prior formalities, fraudulent collection, misusing a file's declared purpose, continuing to process despite a valid objection or rectification request, unlawful retention beyond the declared duration, or an unauthorized disclosure harming a person's standing or privacy.
Expect the Ministry in charge of the digital economy to perform the agency's supervisory functions until the dedicated agency is formally established, within twelve months of the Act's promulgation.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Chapitre VIII, Section 2 sets several tiers: six months to five years' imprisonment and a fine of FCFA 100,000 to 5,000,000 for obstructing the data protection agency; six months to two years and FCFA 100,000 to 2,000,000 for negligent processing without required formalities or for unlawful retention beyond the declared duration; two to five years and FCFA 1,000,000 to 10,000,000 for fraudulent collection, misusing a file's declared purpose, processing despite a valid objection or rectification request, or a disclosure harming a person's standing or privacy. The Act states that only the administrative pecuniary sanction under Section 1 is doubled on repeat conduct; it does not state that the criminal fines double.

Penalty structure

Administrative pecuniary sanction the data protection agency may impose for a breach of the Act (Chapitre VIII, Section 1), doubled on repeat conduct; separate fixed criminal fines and imprisonment apply under Section 2 for specific offences (see criminal_exposure_note). No fixed monetary cap is stated for the turnover based fine.

Rule: Turnover pct only
As of: 19 September 2026
Turnover percentage cap: 5

Who enforces it

Enforcement body

Agence en charge de la protection des données à caractère personnel (interim oversight resting with the Ministry in charge of the digital economy pending the agency's formal constitution)

What it reaches

Obligation class

Governance, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The agency may impose against a controller, for a breach of one or more provisions of the Act, a warning, an order to stop the processing, a pecuniary sanction, or the withdrawal of a granted authorization or certification.

In an emergency, where a processing activity or the exploitation of data violates the rights and freedoms the Act's opening articles protect, the agency may order the interruption of the processing for up to three months, or lock certain data for up to three months where the processing serves only State security, national defense, or public safety purposes.

A pecuniary sanction is doubled on repeat conduct, and where the breach is grave and immediate the agency may ask the competent court, by way of an emergency referral, to order any security measure the rights and freedoms require. A sanction is decided on the basis of a report, gives the controller a chance to make written and oral observations and be represented, and results in a reasoned, published decision the controller may appeal to the administrative courts, at the sanctioned party's cost.

The pecuniary sanction cannot exceed 5 percent of the controller's turnover, excluding tax, for the last closed financial year, and is recovered like a debt owed the State.

Separate criminal penalties apply, from six months to five years' imprisonment and a fine of 100,000 to 10,000,000 FCFA depending on the offence, for obstructing the agency's missions, for negligently processing personal data without observing the Act's required prior formalities, for retaining data beyond the duration declared to the agency outside an historical, statistical, or scientific exception, for collecting data by a fraudulent, unfair, or unlawful means, for misusing a file's declared purpose, for continuing to process despite a person's well founded objection or rectification request, or for an unauthorized disclosure that harms a person's standing or the privacy of their life.

A court may order the erasure of data involved in an offence, and the agency's members and agents are empowered to establish that the erasure took place. The Ministry in charge of the digital economy has twelve months from the Act's promulgation to establish the dedicated agency, and performs the agency's functions itself in the meantime.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
is_listed_company

Read the law

Text of Loi n° 24.001 portant protection des données à caractère personnel
archived copy of the Autorité de Régulation des Communications Électroniques et de la Poste (ARCEP) publication

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived June 22, 2026. Publisher's page: https://www.arcep.cf/fr/images/documents/reglementation/lois/Loi_24_001_portant_protection_des_donnes_a_caractere_personnel.PDF

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app