SenegalLoi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel, Commission des Données Personnelles et sanctions
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 January 2008.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Cooperate with the CDP's on-site inspections and give its members or agents any document they need for their mission.
- Comply with a CDP warning or formal notice within the period it sets, or face suspension or definitive withdrawal of your processing authorization and a pecuniary fine of one million to one hundred million CFA francs.
- Expect the CDP to interrupt your processing, lock the data, or ban the processing without prior formal notice where it creates an urgent risk to rights and freedoms.
- Expect a violation of the Act to be prosecuted under the Penal Code and the cybercrime law, carrying imprisonment and fines as those instruments set.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
The Act's own art. 75 refers enforcement to the Penal Code and the cybercrime law; Loi n° 2008-11 sets a prison term of one to seven years and/or a fine of 500,000 to 10,000,000 CFA francs for most offenses against Loi n° 2008-12's processing duties (arts. 431-17 to 431-29 of the Penal Code as inserted), a lower tier of six months to five years and 300,000 to 5,000,000 CFA francs for negligent unlawful disclosure (art. 431-30, second paragraph), and conditions prosecution of an unlawful-disclosure offense on the victim's own complaint. Separately from that criminal exposure, the CDP itself may impose an administrative pecuniary fine of one million to one hundred million CFA francs where a controller does not comply with a formal notice (art. 30), after first provisionally or definitively withdrawing the controller's authorization.
Penalty structure
The one-to-seven-year, 500,000-to-10,000,000-franc tier covers most processing offenses inserted into the Penal Code by Loi n° 2008-11 (arts. 431-17 to 431-29) against Loi n° 2008-12's duties; a distinct lower tier (six months to five years, 300,000 to 5,000,000 francs) applies to negligent unlawful disclosure under art. 431-30's second paragraph, and a separate, smaller tier (six months to two years, 200,000 to 1,000,000 francs) punishes obstructing the CDP itself under art. 431-31, which is not a processing-duty offense. This figure is the criminal tier only: the CDP's own administrative pecuniary sanction under art. 30 of Loi n° 2008-12 runs one million to one hundred million CFA francs and is coded separately in criminal_exposure_note.
- Rule
- Fixed only
- As of
- 19 September 2026
- Minimum
- 500,000
- Currency
- XOF
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
Commission de Protection des Données à Caractère Personnel (CDP)
What it reaches
Obligation class
Governance, Reporting
Who checks it
Audit expectation
on_request
Who audits it
Regulator
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 5 creates the Commission de Protection des Données à Caractère Personnel, the CDP, as an independent administrative authority charged with ensuring processing complies with the Act, informing data subjects and controllers of their rights and duties, and checking that information and communication technologies do not threaten public freedoms or privacy.
Article 6 sets its eleven members, drawn from the Presidency, the National Assembly, the Senate, employer organizations, the Conseil d'Etat, the Cour de Cassation, the bar, human rights organizations, and the head of the State computing agency, appointed by decree, with a government commissioner who attends without voting.
Article 8 gives members a four year, once renewable term, bars removal except by resignation or an impediment the CDP itself finds, and binds them to professional secrecy, while article 12 gives them full immunity for opinions expressed in office and bars any authority from instructing them.
Article 16 lists the CDP's missions, including receiving declarations, complaints and petitions, referring offences to the public prosecutor without delay, ordering verifications, sanctioning a controller under articles 29 through 32, answering opinion requests, approving codes of conduct, keeping a public register of processing, advising controllers, authorizing cross border transfers, proposing legislative improvements, cooperating internationally, publishing its authorizations, and reporting annually to the President of the Republic and the President of the National Assembly.
Articles 25 through 27 let CDP members and sworn agents inspect premises used for processing, subject to a regional court's authorization if the occupant objects, and demand and copy any document useful to their mission, and article 28 requires an adversarial record of every inspection.
Article 29 lets the CDP warn a controller and give formal notice to end a breach within a set period, and article 30 lets it, after a contradictory procedure, provisionally or definitively withdraw an authorization and impose a pecuniary fine of one million to one hundred million CFA francs where the controller does not comply.
Article 31 lets the CDP, in an emergency threatening rights and freedoms, order the interruption of a processing operation, the locking of data, or a temporary or definitive ban on a processing that violates the Act, each after a contradictory procedure, and article 32 lets any CDP sanction or decision be appealed to the Conseil d'Etat. Article 75 refers violations of the Act to the Penal Code and the cybercrime law rather than setting its own criminal penalties.
When LexLint raises it
crawls_webtrains_modelsautomated_outreach
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.