Data protection & privacy laws in Senegal (2026)

Act No. 2008-12 of 25 January 2008 sets out core data-protection principles (lawfulness, purpose limitation, proportionality, data quality, security) and establishes rights of data subjects and obligations for controllers and processors. It is supplemented by Act No. 2008-08 on electronic transactions.

The Commission de Protection des Données Personnelles (CDP), created by the 2008 law, is an independent administrative authority headquartered in Dakar. It receives complaints, conducts inspections, issues binding decisions and opinions, and can impose administrative and criminal sanctions.

Controllers must file a prior declaration with the CDP before initiating most personal-data processing operations; certain sensitive or high-risk processing categories require prior authorisation rather than mere declaration. There is no obligation to appoint a Data Protection Officer.

Individuals hold rights to information, access, rectification, and objection. The law does not include a general right to erasure or portability comparable to the GDPR, and there is no mandatory personal-data breach notification obligation.

Transfers abroad are permitted only to countries offering an adequate level of protection for privacy and fundamental rights. Transfers to inadequate-protection countries require explicit data-subject consent, protection of life, public interest, or execution of a contract in the data subject's interest.

Criminal penalties reach up to 7 years' imprisonment — among the harshest in West Africa. A 2019 reform bill (targeting AI, biometrics, cloud, big data and GDPR alignment) was published for public comment but had not been enacted as of May 2026; the 2008 law therefore remains in force.