Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)
Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 25 January 2008.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Have a lawful basis, ordinarily the person's consent, before collecting, processing, transmitting, storing, or using their personal data.
- Before collecting or processing data revealing racial, ethnic, or regional origin, political opinion, religious or philosophical belief, trade-union membership, sexual life, genetic data, or health, confirm one of the Act's narrow exceptions applies.
- Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, and any recipients, and let them access, object to, correct, or delete their data on request.
- Do not transfer personal data outside Senegal unless the destination country offers a sufficient level of protection and the CDP has been notified first, or a narrow consent-based or public-interest derogation applies.
- Take precautions appropriate to the nature of the data, including restricting access to authorized staff and keeping security copies.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
The Act's own art. 75 refers enforcement to the Penal Code and the cybercrime law; Loi n° 2008-11 sets a prison term of one to seven years and/or a fine of 500,000 to 10,000,000 CFA francs for most offenses against Loi n° 2008-12's processing duties (arts. 431-17 to 431-29 of the Penal Code as inserted), a lower tier of six months to five years and 300,000 to 5,000,000 CFA francs for negligent unlawful disclosure (art. 431-30, second paragraph), and conditions prosecution of an unlawful-disclosure offense on the victim's own complaint.
Penalty structure
The one-to-seven-year, 500,000-to-10,000,000-franc tier covers most processing offenses inserted into the Penal Code by Loi n° 2008-11 (arts. 431-17 to 431-29) against Loi n° 2008-12's duties; a distinct lower tier (six months to five years, 300,000 to 5,000,000 francs) applies to negligent unlawful disclosure under art. 431-30's second paragraph, and a separate, smaller tier (six months to two years, 200,000 to 1,000,000 francs) punishes obstructing the CDP itself under art. 431-31, which is not a processing-duty offense.
- Rule
- Fixed only
- As of
- 5 September 2026
- Minimum
- 500,000
- Currency
- XOF
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
Commission de Protection des Données à Caractère Personnel (CDP)
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Transfer, Security
Who checks it
Audit expectation
on_request
Who audits it
Regulator
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 33 makes a data subject's consent the general basis for lawful processing, with derogations for a legal obligation, a public-interest or official mission, performance of a contract, or safeguarding the data subject's vital interests.
Article 40 prohibits collecting or processing data revealing racial, ethnic or regional origin, filiation, political opinion, religious or philosophical belief, trade-union membership, sexual life, genetic data, or health, subject to article 41's exceptions for data the person has manifestly made public, written consent, vital-interest necessity, and several public-interest grounds.
Articles 58 through 69 give the data subject a right to be informed at collection, a right of access to and a copy of their data, a right to object to processing for legitimate reasons (including direct marketing), and a right to have inaccurate, incomplete, or unlawfully held data rectified or deleted.
Article 49 bars transferring personal data to a country that does not ensure a sufficient level of protection unless the controller first notifies the CDP, and article 50 permits a transfer to a country without such protection only where it is a one-off, non-massive transfer made with the person's express consent or is necessary to protect life, the public interest, a legal claim, or a contract.
Article 71 requires a controller to take precautions appropriate to the nature of the data, including access controls, audit trails, and security copies, but neither article 71 nor any other provision located requires notifying the CDP or the affected person of a security breach. Article 75 states that violations of the Act are punished under the Penal Code and the law on cybercrime.
That cybercrime law, Loi n° 2008-11, in turn sets prison terms of one to seven years and fines of 500,000 to 10,000,000 CFA francs for most of the processing offenses it creates against Loi n° 2008-12's duties, a lower six-months-to-five-years and 300,000-to-5,000,000-franc tier for negligent unlawful disclosure, and requires the victim's own complaint before prosecuting an unlawful-disclosure offense.
When LexLint raises it
crawls_webtrains_modelsautomated_outreach