TogoLoi n° 2019-014, cadre institutionnel et dispositions pénales
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Expect the Instance de Protection des Données à Caractère Personnel to investigate complaints, petitions and claims about your processing, tell their authors the outcome, and alert the public prosecutor to any offense it learns of.
- Comply with a warning or formal notice the Instance issues within the period it sets, or face a provisional or, ultimately, definitive withdrawal of your authorization, an administrative fine of up to XOF 100,000,000, interruption of the processing, data locking, or a daily penalty of up to XOF 5,000,000, after a hearing.
- Do not obstruct the Instance's action by opposing its members' or agents' missions, refusing to communicate the information or documents they request, or supplying information that does not match your records.
- Expect criminal liability of up to five years' imprisonment and a fine of up to XOF 25,000,000 for processing without the required formalities, unauthorized use of the national identification number, fraudulent data collection, unlawful processing of sensitive or offense related data, breach of the right to object, misuse of data beyond its declared purpose, or unauthorized disclosure of data.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Chapter VII (arts. 79 to 93) fixes a distinct imprisonment and fine range for each offense. The base tier, covering processing without the required formalities (art. 79), continuing to process after a provisional authorization withdrawal (art. 80), unauthorized use of the national identification number (art. 82), failing to implement required security measures (art. 83), unlawfully processing sensitive data (art. 86) or offense related data (art. 87), exceeding or processing beyond the legal retention period (arts. 89 to 90), and intentional unauthorized disclosure (art. 92, first paragraph), carries one to five years' imprisonment and a fine of XOF 1,000,000 to XOF 10,000,000, or either penalty alone. A higher tier applies to fraudulent data collection and breach of the right to object to marketing (arts. 84 to 85), at one to five years and XOF 5,000,000 to XOF 20,000,000, and to unlawful health research processing and misuse of data beyond its declared purpose (arts. 88 and 91), at one to five years and XOF 5,000,000 to XOF 25,000,000. Violating simplified or exemption norms (art. 81) carries one to three years and XOF 500,000 to XOF 5,000,000, or three months to one year and XOF 100,000 to XOF 1,000,000 where committed negligently; negligence also lowers the article 79 and article 80 offenses to one to three years and XOF 500,000 to XOF 5,000,000. Negligent unauthorized disclosure (art. 92, second paragraph) and hindering the Instance's action (art. 93) each carry six months to two years, at XOF 500,000 to XOF 2,000,000 for negligent disclosure and XOF 1,000,000 to XOF 10,000,000 for hindering the Instance.
Penalty structure
The Instance may impose an administrative fine of up to XOF 100,000,000 for breach of an authorization it granted, after a contradictory procedure (art. 71), separate from the criminal fines of XOF 100,000 to XOF 25,000,000 stated for the distinct offenses in arts. 79 to 93.
- Rule
- Fixed only
- As of
- 19 September 2026
- Currency
- XOF
- Fixed cap
- 100,000,000
Who enforces it
Enforcement body
Instance de Protection des Données à Caractère Personnel (IPDCP)
What it reaches
Obligation class
Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 55 creates the Instance de Protection des Données à Caractère Personnel (IPDCP) as an independent administrative authority tasked with ensuring that processing complies with the law, and article 56 gives it the missions of receiving formalities, receiving and answering complaints, alerting the public prosecutor to offenses it learns of, verifying processing, sanctioning controllers under article 71, answering opinion requests, approving conduct codes, keeping a public register, advising controllers, authorizing cross border transfers, proposing legislative improvements, cooperating internationally, publishing authorizations and opinions, and reporting annually to the President, the Prime Minister and the presidents of the two legislative chambers.
Article 70 lets the Instance issue a warning or a formal notice fixing a deadline to end a breach, and article 71 lets it, after a hearing, provisionally or ultimately withdraw an authorization or impose a fine of up to XOF 100,000,000 where the controller does not comply.
Articles 72 and 73 let the Instance take emergency and conservatory measures, including interrupting a processing operation, locking data, ordering compliance under a daily penalty of up to XOF 5,000,000, or sealing and removing equipment used in an unauthorized processing operation, and article 74 lets the Instance's decisions be appealed before the administrative chamber of the Supreme Court.
Article 93 punishes obstructing the Instance's action, whether by opposing its members' or agents' missions, refusing to communicate the information or documents they request, or supplying information that does not match the records, with six months to two years' imprisonment and a fine of XOF 1,000,000 to XOF 10,000,000.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbothigh_risk_decisions
Read the law
Journal Officiel de la République Togolaise
numéro spécial du 29 octobre 2019, cited through an Internet Archive capture of the Ministry of the Digital Economy's PDF (numerique.gouv.tg)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2020. Publisher's page: https://numerique.gouv.tg/wp-content/uploads/2020/01/Loi-n-2019-014-du-29-octobre-2019-relative-a-la-protection-des-donnees-a-caractere-pers…Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.