Mauritania

Article premier sets the law's object as establishing a normative and institutional framework for processing personal data, so that any processing of personal data, in whatever form, respects citizens' fundamental freedoms and rights.

Article 25 lets the Authority authorise a transfer of personal data to a country that does not ensure an adequate level of protection, on a duly motivated request, where the controller offers sufficient guarantees, which may take the form of appropriate contractual clauses.

Article 72 binds ministers, public authorities, and public or private company directors alike to take all measures to facilitate the Authority's work, so the law's institutional obligations reach both public bodies and private controllers.

Articles 65 through 73 establish the Authority's composition, a four-year renewable-once mandate for its members, their professional-secrecy duty, and its missions, including receiving prior formalities, receiving complaints, ordering verifications, and authorising cross-border transfers.

Articles 74 through 79 give the Authority's agents inspection powers over premises used for personal-data processing, subject to judicial authorisation on the responsible party's objection, and let the Authority issue a warning, a formal notice, or, after that notice is not complied with, a temporary or definitive withdrawal of an authorisation or a pecuniary sanction.

Article 80 caps that pecuniary sanction at 10,000,000 ouguiya for a first breach, rising to 50,000,000 ouguiya, or, for a company, 5% of the last closed financial year's turnover excluding tax, for a repeated breach within five years of a prior final sanction.

Articles 84 through 98 set criminal offences and penalties, including for processing personal data without completing the law's prior formalities, collecting personal data by fraudulent or unlawful means, and processing a person's data despite their valid objection, notably to commercial prospecting. Article 101 ties the law's execution to publication in the Official Gazette, immediately above the promulgation dateline of 22 July 2017.

Article 6 punishes anyone who accesses or attempts to access, intentionally and without right, all or part of a computer system, with one to three years' imprisonment and a fine of 100,000 to 2,000,000 ouguiya, or either penalty alone. Article 7 punishes remaining, or attempting to remain, connected to all or part of a computer system in the same conditions with a heavier penalty of two to four years' imprisonment and a fine of 200,000 to 3,000,000 ouguiya, or either penalty alone.

Neither article states that the offence requires defeating a technical security measure to gain access, unlike some comparable statutes elsewhere; the standard is only that the access be intentional and without right, so a plain reading leaves open whether reading a public, unauthenticated page without any technical control to defeat counts as access without right, and no reported Mauritanian decision has construed the phrase.

Article 2 confines the statute to offences linked to the use of information and communication technologies and excludes sound and television broadcasting services from its scope. Article 52 ties the law's execution to publication in the Official Gazette, immediately after the President's promulgation dateline of 20 January 2016.