🇧🇫
Burkina Faso
Law No. 001-2021/AN on the Protection of Persons with Regard to Personal Data Processing
Africa🔵 Substantial
Compliance Score
36%
5 Addressed
7 Partial
2 None
Authority
Commission on Information Technology and Civil Liberties (CIL)
Overview
Burkina Faso's 2021 personal-data law sets rules for processing and provides for oversight by the CIL. Detailed obligations should be checked against official implementing texts and regulator guidance.
14-Topic Coverage Analysis
Data Protection Authority
AddressedConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
AddressedBreach Notification
PartialDPO Requirements
PartialChildren's Data
PartialPenalties & Enforcement
AddressedSector-Specific Rules
PartialCookie/Tracking
PartialAI & Automated Decisions
NoneData Localisation
PartialSignificant Data Fiduciary
NoneGovernment Data
Partial? Frequently Asked Questions
What is the primary data protection law in Burkina Faso?+
Burkina Faso is governed by the Law No. 001-2021/AN on the Protection of Persons with Regard to Personal Data Processing. The law is enforced by the Commission on Information Technology and Civil Liberties (CIL). According to our analysis, the country has a Substantial level of data protection framework.
Does Burkina Faso require a Data Protection Officer (DPO)?+
Partially. The Law No. 001-2021/AN on the Protection of Persons with Regard to Personal Data Processing may require a DPO only for specific high-risk organizations or sectors. It is not universally mandatory for all businesses.
What are the data localisation rules in Burkina Faso?+
Partially. While Law No. 001-2021/AN on the Protection of Persons with Regard to Personal Data Processing may not mandate general localisation, specific sectoral laws (like finance or health) might require data to be stored locally.
What are the breach notification requirements in Burkina Faso?+
The Law No. 001-2021/AN on the Protection of Persons with Regard to Personal Data Processing has limited breach notification requirements. It may only require notifying the regulator, without mandating notification to affected individuals.