Madagascar
Law No. 2014-038 on Personal Data Protection
Authority
Commission Malagasy de l'Informatique et des Libertés (CMIL)
Overview
Madagascar’s data protection regime rests on Law No. 2014-038 of January 9, 2015, a comprehensive statute that imposes prior declaration or authorization requirements on most personal data processing activities. Enforcement is entrusted to the Commission Malagasy de l’Informatique et des Libertés (CMIL), an independent administrative authority that only became fully operational in December 2023—nearly nine years after the law’s enactment . Since then, the CMIL has begun exercising its supervisory powers, including warnings, compliance notices, authorization withdrawals, and financial sanctions of up to 5% of the previous financial year’s pre-tax turnover . Criminal penalties for processing without prior declaration or authorization range from six months to two years’ imprisonment . Organizations must also appoint a Data Protection Officer in certain cases and maintain detailed processing registers. Notably, the law does not establish a general obligation to notify the CMIL or affected individuals of data breaches—a gap that distinguishes Madagascar from GDPR-style frameworks . The 2024 ratification of the Malabo Convention signals Madagascar’s intent to align further with continental data protection standards, though domestic implementing reforms remain pending.