Cybersecurity regulation in Burkina Faso (2026)

The Transitional Legislative Assembly unanimously adopted the Law on Information Systems Security on 9 July 2024. The draft was approved in Cabinet in November 2023. The law text is published by the Ministry of Digital Transition (MDENP).

The National Agency for Information Systems Security (ANSSI), created in 2013, is designated as the body responsible for applying the 2024 law. In July 2024 it was placed under the Ministry of Digital Transition to strengthen operational capacity.

The law applies to public administrations and private-sector economic entities. It imposes strict security standards to protect sensitive data, ensure continuity of public services, and support the dematerialisation of administrative procedures.

Electronic communications operators are required to notify ARCEP (the telecom regulator) of any security or integrity breach that significantly impacts network or service functioning, per Article 45 of Law 027-2010/AN of 25 May 2010 on electronic services and transactions. The 2024 law extends and reinforces such obligations across sectors.

On 5 March 2025, the Council of Ministers adopted a decree setting conditions and procedures for granting, renewing and withdrawing technical approvals for cybersecurity materials and software, implementing Law 014-2024. Commercial sale of cybersecurity products now requires prior approval.

ARCEP (telecom regulator) launched DNSSEC for the national '.bf' domain in December 2025 and has conducted audits to update the broader digital legal and regulatory framework, complementing ANSSI's cybersecurity mandate.