Data protection & privacy laws in Burkina Faso (2026)

Law No. 001-2021/AN of 30 March 2021 replaced Law No. 010-2004/AN and modernised the data protection framework. It covers all automated and manual processing of personal data by controllers and processors operating in Burkina Faso, establishing principles of consent, purpose limitation, proportionality, and data security.

The Commission de l'Informatique et des Libertés (CIL) is the independent DPA, first made operational in December 2007 — the first such authority in Francophone sub-Saharan Africa. It has nine members appointed by the Council of Ministers for renewable five-year terms and holds powers to investigate, issue compliance notices, impose financial penalties, and refer violations to prosecutors.

Data controllers must obtain prior consent from data subjects, register all processing activities with the CIL (unless exempted), ensure security and confidentiality, and conclude a data-processing contract with any processor. Cross-border transfers to third countries require a contractual guarantee of data return and encryption.

Individuals hold rights to: informed notice at the point of collection; access to their data without excessive cost; rectification of inaccurate or incomplete data; opposition to processing for legitimate reasons or for direct marketing; and protection from adverse decisions based solely on automated processing.

Law No. 2024/017 of 23 December 2024 on the protection of personal data was adopted by the transitional legislature (Assemblée Législative de Transition). Implementing decrees and ministerial orders had not yet been published as of early 2025, meaning the 2021 framework remains the operative instrument in practice.

In August 2025 the CIL launched a major enforcement sweep, issuing compliance notices to over 1,300 organisations across key economic sectors to assess adherence to data-processing principles, privacy-by-design requirements, and data subject rights. The government also suspended two international NGOs for unauthorised cross-border data transfers, signalling increased enforcement under the new administrative sanctions framework.