Togo

Article 55 creates the Instance de Protection des Données à Caractère Personnel (IPDCP) as the independent supervisory authority. Article 1 regulates the collection, processing, transmission, storage, use and protection of personal data, and article 2 extends the law to any collection, processing, transmission, storage or use of personal data by a natural person, the State, a local authority, or a public or private legal person, whether the processing is automated or not.

Article 14 makes consent the general lawful basis for processing, subject to derogations for a legal obligation, a public-interest task, performing a contract, or protecting the data subject's vital interests, and articles 15 to 20 set the purpose-limitation, accuracy, transparency, confidentiality, security and sub-processor-selection principles.

Article 21 prohibits processing data revealing racial or ethnic origin, political, religious or philosophical opinions, trade-union membership, sex life, health or genetic data, subject to article 22's exceptions for data the person has manifestly made public, the person's written consent, safeguarding a vital interest, or a public-interest, judicial or historical, statistical or scientific purpose.

Article 8 requires the Instance's prior authorization before a treatment of genetic data or health research, criminal-record or security-measure data, an interconnection of files, a national identification number, or biometric data, while most other processing is only declared to the Instance under article 6.

Article 26 bars unsolicited direct marketing to a person who has not given prior consent, and article 27 bars founding a legal decision solely on an automated evaluation of a person's characteristics or personality.

Article 28 requires due consideration of the destination country's level of protection before a transfer of personal data outside Togo, and article 29 admits a one-off, non-massive transfer without that showing where the data subject has consented or the transfer serves one of a short list of vital, public-interest or contractual grounds.

Chapter VII (arts. 79 to 93) states distinct criminal offenses for processing without the required formalities, unauthorized use of a national identification number, fraudulent or unauthorized data collection, unlawful processing of sensitive or infraction-related data, breach of the right to object, misuse of data beyond its declared purpose, unauthorized disclosure, and hindering the Instance's action, each carrying its own imprisonment and fine range; the sources read state no separate data-breach notification duty to the Instance or to the persons affected.

Article 8 punishes any person who, without right, accesses or attempts to access, or remains or attempts to remain, in all or part of a computer system, with six months to two years' imprisonment and a fine of XOF 5,000,000 to XOF 20,000,000, or either penalty alone. The penalty doubles where the access results in a serious disruption or interruption of the system.

It rises to five years' imprisonment and a fine of XOF 15,000,000 to XOF 60,000,000 where the offense is committed to the detriment of the Togolese State.

The provision's trigger is access without right rather than the circumvention of a security measure, so unlike a statute that requires infringing an access control, its plain text does not on its own resolve whether reading a public, unauthenticated page falls inside or outside the offense, and no reported Togolese decision has addressed the question.

Article 9 of the same law separately punishes destroying, hindering, falsifying, disrupting or interrupting the functioning of a computer system, and article 10 separately punishes introducing, deleting, altering, destroying, extracting or intercepting computerised data, each with three to five years' imprisonment and a fine of XOF 25,000,000 to XOF 100,000,000; both are aimed at interference with or extraction of data from a system rather than passive reading of a page it makes public.

Article 21 permits, once a work has been lawfully made accessible to the public and provided the work's title and the author's name are mentioned, short analyses and quotations taken from it, including quotations of newspaper and periodical articles in the form of a press review, where they conform to fair usage and are justified by a scientific, critical, polemical, teaching or informational purpose; such quotations and analyses may be used in the original or in translation.

Article 22 separately permits reproducing by the press, or broadcasting, for informational purposes, political, social or economic news articles published in their original form or in translation, and speeches delivered in public at official ceremonies or at political, judicial, administrative or religious meetings and assemblies. This is on condition that the author's name and the source are mentioned and that the right of reproduction has not been expressly reserved.

Neither article caps the quotation or the reproduction at a headline-length or short-extract threshold beyond the fair-usage and informational-purpose tests, and no reported Togolese decision applies either article to a systematic aggregator's reproduction of headlines and snippets, as opposed to an individual quotation or a traditional press review.

Togo has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright and the law's civil seizure remedies, and no located case law on hyperlinking or framed display.