Data protection & privacy law in Côte d'Ivoire (2026)

African data protection authorities from 24 countries convened in Abidjan for the 9th RAPDP conference hosted by ARTCI, adopting a 2026–2030 continental roadmap targeting AI, digital platforms, and biometric data. The Declaration frames personal data protection as a pillar of state sovereignty and economic attractiveness across Africa.

A comprehensive 252-article electronic communications law restructured ARTCI's oversight of operators, embedding explicit data-related obligations for telecoms providers and strengthening consumer protections for digital services. It replaces the prior sector framework and operationalises data protection within the communications regulatory regime.

After 10 named mobile lending applications failed to respond to ARTCI's August 2023 compliance ultimatum, ARTCI published a second communiqué exposing the apps by name and confirming formal mise en demeure notices — the most significant public enforcement action taken under Law No. 2013-450 to date, targeting systematic data misuse for blackmail and extortion.

ARTCI issued a public communiqué alerting citizens to serious data protection violations by mobile lending apps — including harvesting contacts and photos for blackmail — and gave operators 10 days to comply with Law No. 2013-450; the first major regulatory alert specifically enforcing the 2013 data protection statute.

The African Union's Malabo Convention entered into force 30 days after Mauritania became the 15th ratifying state, with Côte d'Ivoire among the ratifiers; the Convention creates binding continental standards on data protection and cybercrime that legally supplement Côte d'Ivoire's domestic Law No. 2013-450.

The Ivorian Council of Ministers adopted the bill authorising ratification of the 2014 African Union Convention on Cyber Security and Personal Data Protection; the instrument was formally deposited with the AU in April 2023, making Côte d'Ivoire one of the 15 states that triggered the Convention's entry into force.

Adopted by referendum on 30 October 2016, the new Ivorian Constitution enshrines the right to privacy, including protection of personal data, under Article 8, providing explicit constitutional foundation for data protection legislation and entrenching it against ordinary legislative repeal.

Enacted the same day as Law No. 2013-450, this cybercrime law criminalises unauthorised access, data interception, digital fraud, and online privacy violations, providing the criminal-law complement to the administrative data protection regime and addressing cyber-enabled personal data breaches.

Côte d'Ivoire's primary data protection law, implementing the ECOWAS 2010 Supplementary Act, establishes consent-based processing rules, data subject rights (access, rectification, erasure, objection), mandatory prior declaration or authorisation with ARTCI, restrictions on sensitive data and cross-border transfers, and criminal penalties — designating ARTCI as the independent supervisory authority and making Côte d'Ivoire among the earliest West African states with a comprehensive data protection law.

All 15 ECOWAS member states — including Côte d'Ivoire — became bound by this regional framework requiring national data protection laws and independent supervisory authorities built on the principles of legality, purpose limitation, proportionality, and data subject rights; it directly triggered Côte d'Ivoire's subsequent enactment of Law No. 2013-450.