Loi n° 2013-015, protection des données à caractère personnel
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 28 June 2013.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Collect and process personal data fairly and lawfully, only for determined, explicit, and legitimate purposes, and do not use the data for a different purpose.
- Do not base a decision producing legal effects for a person solely on an automated processing designed to profile them or evaluate aspects of their personality.
- Take every precaution useful to preserve the security of personal data, including preventing unauthorized access, deformation, or damage.
- Do not process sensitive data (religious, philosophical, political, or union opinions or activities; sexual life or racial origin; health; or criminal prosecutions, convictions, or measures) unless a derogation approved by the Autorité de Protection des Données à Caractère Personnel applies.
- Before transferring personal data outside Mali, confirm that the destination country's protection has been recognized as sufficient by the Autorité, or put in place contractual clauses or internal rules providing a sufficient level of protection.
- At the time of collection, give the person whose data is collected notice of the controller's identity, the purpose of processing, the categories of data, and their rights, including the right to object.
- Honor a person's right to access, rectify, complete, update, block, or delete personal data concerning them, and their right to object to processing or to communication of their data to third parties for prospecting purposes.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 64 states that, besides the pecuniary sanctions set at articles 65 to 67, custodial criminal sanctions also apply to these offences; article 58 refers the classification of offences and the applicable penalties to the Penal Code, so the Act itself does not state a term of imprisonment.
Penalty structure
Article 65 sets a fine of 5,000,000 to 20,000,000 CFA francs for the most serious violations (unauthorized disclosure of or access to personal data affecting fundamental rights or privacy, purpose diversion, fraudulent collection, unauthorized health-research processing, unlawfully retaining criminal-record data, and obstructing the Autorité's investigations). Article 66 separately sets a fine of 2,500,000 to 10,000,000 CFA francs for security-safeguard failures and for storing racial, ethnic, or political, philosophical, religious, or union opinion data without the person's prior consent.
- Rule
- Fixed only
- As of
- 5 September 2026
- Minimum
- 5,000,000
- Currency
- XOF
- Fixed cap
- 20,000,000
Who enforces it
Enforcement body
Autorité de Protection des Données à Caractère Personnel (APDP)
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Transfer, Security, Reporting
Who checks it
Audit expectation
on_request
Who audits it
Regulator
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 1 requires the Malian State to protect the personal data of every natural or legal, public or private person, and article 2 prohibits basing a decision producing legal effects for someone solely on an automated processing intended to profile them or assess aspects of their personality.
Article 5 subjects to the Act any processing of personal data by the State, territorial authorities, incorporated bodies, and private natural or legal persons, and any processing implemented by a controller established or not on Malian territory, excluding only means used solely for transit.
Article 6 excludes just two categories from the Act's scope: processing by a natural person for exclusively personal or domestic activities not intended for systematic communication to third parties or dissemination, and temporary technical copies made for network transmission.
Article 7 requires personal data to be collected and processed fairly and lawfully, for determined, explicit, and legitimate purposes, and article 8 requires the controller to take every precaution useful to preserve data security, including preventing deformation, damage, or unauthorized third-party access.
Article 9 prohibits processing sensitive data (data relating to religious, philosophical, political, or union opinions or activities, sexual life or racial origin, health, or social measures, prosecutions, or criminal or administrative sanctions) unless the Autorité de Protection des Données à Caractère Personnel has approved a derogation meeting one of three conditions: necessity to safeguard the life of the data subject or a third party where consent cannot be given, implementation by a non-profit religious, philosophical, political, or union body solely to manage its own members, or necessity to establish, exercise, or defend a legal right.
Article 11 conditions transfer of personal data to a foreign country on the Autorité recognizing that the destination State ensures a sufficient level of protection, or on the Autorité deciding that the transfer and the recipient's processing guarantee a sufficient level of protection, including through contractual clauses or internal rules.
Articles 12 through 19 give a person the right to obtain a free copy of data concerning them, to have inaccurate, incomplete, or unlawfully processed data rectified, completed, updated, blocked, or deleted, to be informed at collection of the controller's identity, the purpose of processing, the categories of data, and their rights, and to object, for legitimate reasons, to a processing of their data or to its communication to third parties for prospecting purposes.
Articles 20 through 52 establish the Autorité as an independent administrative authority empowered to set data-processing norms, authorize interconnections and transfers, receive complaints, inspect processing operations, and impose administrative sanctions, and article 57 requires a controller to declare to the Autorité the processing operations it intends to carry out for a given purpose.
When LexLint raises it
crawls_webtrains_modelshigh_risk_decisionsautomated_outreachprocesses_biometrics