Loi n° 2022-59, contrôle, sanctions et recours

Loi n° 2022-59, arts. 87-110 (contrôle, sanctions administratives, dispositions pénales et recours)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

An enforcement supervision rule binding public and private bodies.

As of 19 September 2026.

What it requires

Comply with a HAPDP warning or formal notice to end a violation within the deadline it sets, or risk provisional or definitive withdrawal of your processing authorisation and a pecuniary sanction.
Expect the HAPDP to be able to order the interruption of a persistent unlawful processing operation, the locking of the data concerned, or a temporary or permanent ban on the processing, after a contradictory procedure.
Expect a pecuniary sanction proportional to the seriousness of the violation, capped at 100,000,000 CFA francs, rising to 200,000,000 francs, or, if you are a company, to 5 percent of your previous financial year's turnover excluding tax up to 500,000,000 francs, for a repeat violation within two years.
Expect criminal liability on top of any pecuniary sanction for specific violations such as illicit processing of sensitive data, purpose diversion, unauthorised disclosure, fraudulent collection, unlawful retention, or obstructing a data subject's rights or the HAPDP, punished by imprisonment and a fine reaching, for the most serious offences, five years and 50,000,000 francs.
Give a control agent the HAPDP assigns access to the premises and installations where you carry out processing, other than a private home, to verify your compliance.
Let a data subject complain to the HAPDP, including after an unanswered complaint to you, and expect a judicial remedy independent of that complaint, including urgent injunctive relief for a serious and immediate violation of their rights.

If you get it wrong

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Chapter XIV criminalises specific violations of the Act. The heaviest tier, three months to five years' imprisonment and a fine of 5,000,000 to 50,000,000 CFA francs, covers illicit processing of sensitive data (art. 95), purpose diversion (art. 99), unauthorised disclosure or access (art. 100), fraudulent collection (art. 101), unlawful retention (art. 103) and harmful disclosure of private data (art. 104). Direct marketing without consent (art. 96) carries three months to three years and 1,000,000 to 10,000,000 francs; obstructing the HAPDP (art. 97) and failing to secure personal data (art. 98) each carry three months to two years and 1,000,000 to 10,000,000 francs; obstructing a data subject's rights (art. 102) carries three months to two years and 1,000,000 to 20,000,000 francs; and a negligent, rather than intentional, harmful disclosure under article 104 carries a fine alone of 500,000 to 1,000,000 francs with no term of imprisonment.

Penalty structure

Art. 94 sets the HAPDP's pecuniary sanction at a first ceiling of 100,000,000 CFA francs, rising for a repeat violation confirmed within two years of the earlier sanction becoming final to 200,000,000 francs, or, where the offender is a company, to 5 percent of its previous financial year's turnover excluding tax, within a ceiling of 500,000,000 francs. The fixed criminal tiers under Chapter XIV sit below these administrative caps, running from 500,000 to 50,000,000 francs (arts. 95-104).

Rule: Turnover pct only
As of: 19 September 2026
Turnover percentage cap: 5

Who enforces it

Enforcement body

Haute Autorité de Protection des Données à caractère Personnel (HAPDP)

What it reaches

Obligation class

Governance, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 87 lets the HAPDP's President assign sworn control agents to verify compliance with the Act and its own deliberations, and article 88 gives those agents access to the premises, installations and establishments used for a processing operation, excluding the parts serving as a private home.

Article 92 lets the HAPDP issue a warning or a formal notice fixing a deadline to end a violation after a contradictory procedure, and where the controller does not comply, lets it withdraw the processing authorisation, provisionally or definitively, and impose a pecuniary sanction. Article 93 lets it order the interruption of a persistent unlawful processing operation, the locking of the data concerned, or a temporary or permanent ban on the processing.

Article 94 caps a pecuniary sanction proportional to the seriousness of the violation and the advantage gained at 100,000,000 CFA francs, rising, for a repeat violation confirmed within two years of the earlier sanction becoming final, to 200,000,000 francs, or, where the offender is a company, to 5 percent of its previous financial year's turnover excluding tax, within a ceiling of 500,000,000 francs.

Chapter XIV criminalises specific violations, from illicit processing of sensitive data to unauthorised disclosure, fraudulent collection, direct marketing without consent, and obstructing a data subject's rights or the HAPDP itself, each punished with imprisonment and a fine running as high as five years and 50,000,000 francs for the most serious offences.

Article 108 lets a person who considers themselves harmed in their privacy, or whose complaint to the controller went unanswered, complain to the HAPDP. Article 109 lets a person appeal a HAPDP sanction or decision to the Conseil d'État. Article 110 gives a data subject a judicial remedy independent of a HAPDP complaint, including urgent injunctive relief for a serious and immediate violation of their rights.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
high_risk_decisions
is_listed_company

Read the law

Loi n 2022-59 du 16 decembre 2022, version consolidee, Haute Autorite de Protection des Donnees a Caractere Personnel

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app