🇸🇳
Senegal
Law No. 2008-12 on Personal Data Protection
Africa🔵 Substantial
Compliance Score
36%
5 Addressed
7 Partial
2 None
Authority
Commission for the Protection of Personal Data (CDP)
Overview
Senegal's Law No. 2008-12 establishes rules for personal-data processing and a supervisory commission, the CDP. Specific formalities and cross-border-transfer requirements should be checked against current CDP guidance.
14-Topic Coverage Analysis
Data Protection Authority
AddressedConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
AddressedBreach Notification
PartialDPO Requirements
PartialChildren's Data
PartialPenalties & Enforcement
AddressedSector-Specific Rules
PartialCookie/Tracking
PartialAI & Automated Decisions
NoneData Localisation
PartialSignificant Data Fiduciary
NoneGovernment Data
Partial? Frequently Asked Questions
What is the primary data protection law in Senegal?+
Senegal is governed by the Law No. 2008-12 on Personal Data Protection. The law is enforced by the Commission for the Protection of Personal Data (CDP). According to our analysis, the country has a Substantial level of data protection framework.
Does Senegal require a Data Protection Officer (DPO)?+
Partially. The Law No. 2008-12 on Personal Data Protection may require a DPO only for specific high-risk organizations or sectors. It is not universally mandatory for all businesses.
What are the data localisation rules in Senegal?+
Partially. While Law No. 2008-12 on Personal Data Protection may not mandate general localisation, specific sectoral laws (like finance or health) might require data to be stored locally.
What are the breach notification requirements in Senegal?+
The Law No. 2008-12 on Personal Data Protection has limited breach notification requirements. It may only require notifying the regulator, without mandating notification to affected individuals.