Law No. 2013-450 on the Protection of Personal Data
Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
A comprehensive regime rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Have a lawful basis before collecting, transmitting, storing or using anyone's personal data, whether the processing is automated or not, including data collected from a website.
- Declare the processing to ARTCI in advance, or obtain its prior authorization before processing genetic, medical, biometric, offense or conviction, or national-identification-number data, or before transferring personal data to another country.
- Give the person concerned notice of who is responsible for the processing and its purpose before collecting their data.
- Let a person access, object to, rectify, and require the erasure of personal data concerning them.
- Do not send unsolicited electronic direct-marketing messages using a person's personal data without their consent.
- Do not base a court, administrative or private decision assessing a person's behavior or personality solely on automated processing of their personal data.
- Before transferring personal data to another country, confirm it affords an equivalent or higher level of protection and obtain ARTCI's prior permission.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Processing sensitive-category data without an article 21 exemption is punishable by ten to twenty years' imprisonment and a fine of 20 million to 40 million CFA francs (art. 21); unsolicited electronic direct marketing without consent is punishable by one to five years' imprisonment and a fine of 1 million to 10 million CFA francs (art. 22); obstructing the Protection Body is punishable by one month to two years' imprisonment and a fine of 1 million to 10 million CFA francs (art. 45).
Penalty structure
Article 51's administrative and pecuniary penalty for a first breach, without prejudice to any criminal penalty. On a repeated failure within five years the ceiling rises to 100 million CFA francs, or for a company to 5 percent of the prior year's turnover excluding tax up to a maximum of 500 million CFA francs.
- Rule
- Fixed only
- As of
- 6 September 2026
- Currency
- XOF
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI), acting as the Autorité de Protection des données à caractère personnel
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Transfer, Security, Biometric, Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 2 states the Act's purpose as governing the protection of personal data, and article 3 subjects to it any collection, processing, transmission, storage or use of personal data by a natural person, the State, local authorities, or a public or private corporation, whether the processing is automated or not, excluding only an individual's strictly personal or household processing and a network operator's temporary technical copies (art. 4).
Article 5 makes ordinary processing subject to a prior declaration to ARTCI as the Autorité de Protection, while article 7 requires the Authority's prior authorization before processing genetic or medical data, an offense or conviction record, a national identification number, biometric data, data of public-interest research value, or before a cross-border transfer.
Article 21 prohibits, on pain of ten to twenty years' imprisonment and a fine of 20 million to 40 million CFA francs, processing that reveals racial, ethnic or regional origin, political, religious or philosophical opinion, trade-union membership, sex life, or genetic or health data, subject to narrow exceptions including data the person has manifestly made public, protecting a vital interest, or a judicial proceeding.
Article 25 bars any court, administrative or private decision assessing a person's behavior or personality from resting solely on automated processing of their personal data, and article 26 conditions a transfer of personal data to a third country on that country affording an equivalent or higher level of protection and on the Protection Body's prior permission.
Articles 28 to 38 give a data subject the rights to notice, access, objection, rectification, erasure and digital oblivion, and to receive a copy of their data in a portable format, and articles 39 to 44 impose confidentiality and security duties on the person responsible for the processing.
Article 22 punishes unsolicited electronic direct marketing using a person's personal data without their consent by one to five years' imprisonment and a fine of 1 million to 10 million CFA francs, and article 45 punishes obstructing the Protection Body by one month to two years' imprisonment and a fine of 1 million to 10 million CFA francs.
Article 51 lets the Protection Body impose a financial penalty proportionate to the breach, capped at 10 million CFA francs for a first failure and rising, for a repeated failure within five years, to 100 million CFA francs or, for a company, to 5 percent of the prior year's turnover excluding tax up to a maximum of 500 million CFA francs, without prejudice to any criminal penalty; the text states no separate data-breach notification duty running to the Protection Body or to the persons affected.
When LexLint raises it
crawls_webtrains_modelsautomated_outreach
Read the law
Official English-language rendering of Law No. 2013-450 published by ARTCI
(Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire) the French original circulated on ARTCI's own site is a scanned-image PDF with no extractable text layer, so this rendering, whose translation quality is uneven in places, is the readable copy of the Act, an Internet Archive capture