Data protection & privacy laws in Benin (2026)

Law No. 2017-20 of 20 April 2018 (the Digital Code, Book 5) is the principal statute, consolidating the original Law No. 2009-09 of 27 April 2009. It was further amended by Law No. 2020-35 of 6 January 2021, which adjusted the APDP's composition and updated references to the responsible ministry.

The Autorité de Protection des Données Personnelles (APDP) is an independent administrative body with legal personality, responsible for enforcing data-protection rules, issuing authorisations, and receiving complaints from individuals and legal entities. Law No. 2020-35 reduced its membership from 11 to 8 members drawn from the National Assembly, the judiciary, computer-science professionals, and the legal profession.

Data controllers must register or declare processing activities with the APDP before implementation, maintain an internal register of processing operations, apply purpose limitation and data-minimisation principles, implement appropriate security safeguards, and notify the APDP of personal-data breaches without undue delay.

Individuals hold rights of access, rectification, erasure (right to be forgotten), objection, and consent withdrawal against both public authorities and private entities processing their personal data.

Transfers of personal data outside Benin are restricted; recipient countries or organisations must ensure a level of protection equivalent to that required under Beninese law before a transfer may be authorised.

The Digital Code explicitly implements ECOWAS Additional Act A/SA.1/01/10 on the protection of personal data within the ECOWAS space, situating Benin's rules within the broader West African regional framework shared by member states.