Data protection & privacy laws in Mauritania (2026)

Law No. 2017-020 of 22 July 2017 is the foundational statute governing collection, recording, processing, storage and transmission of personal data on Mauritanian territory; it applies to public and private actors alike.

The APD (Autorité de Protection des Données à Caractère Personnel) is the independent national regulator; composed of nine members appointed by the President of the Republic for four-year renewable terms, it became operational after members were sworn in during February 2022.

Controllers must collect data lawfully, fairly and for explicit, legitimate purposes; data must be adequate, relevant and not excessive; retention is limited to the period necessary for the stated purpose; processors must ensure security and confidentiality.

Certain categories of processing require prior authorisation from or notification to the APD before commencement, reflecting a formal registration/approval mechanism analogous to pre-GDPR European models.

The law grants individuals rights of access, rectification, erasure (when data is no longer necessary) and objection to processing; the APD publishes guidance on these rights on its official portal.

On 8 October 2024 the APD signed a Memorandum of Understanding with Algeria's national data-protection authority (ANPDP) to share expertise and conduct joint capacity-building; the APD is also a member of the African Network of Data Protection Authorities (RAPDP).