Senegal

Article 2 of Law 2008-12 sets out who is covered. It covers any company based in Senegal that uses personal data. It also covers a company outside Senegal that uses equipment located in Senegal to handle that data. Equipment used only to route data through the country does not count. In that second case, the law says you must name a representative based in Senegal. What the 2008 text does not cover is a purely foreign operator with no equipment here that simply targets Senegalese users. That gap is one of the main reasons a reform has been discussed since 2020. The regulator has not published a formal reading that settles it. So treat pure remote targeting as a grey area, not as safe.

Industry by industry, as checked on 19 August 2026. BANKING - the strictest rule. Circular 04-2017/CB/C of the Banking Commission of the West African Monetary Union has been in force since 2 July 2018. It says all of an institution's physical and electronic data must be available within the Union. The servers that store the data and run the applications must be in the Union. If the main servers are not, you need backup servers within the Union. Every outsourcing contract must also go to the Banking Commission's Secretariat General to be assessed first. Senegal is a member of the Union, so this binds Senegalese banks and financial holding companies. Rating for banking: a copy must stay. CREDIT REPORTING - Instruction 009-06-2015 makes credit bureaus put their backup media on a site in another member state of the monetary union. That keeps the backups inside the bloc. Rating: a copy must stay. PAYMENTS AND ELECTRONIC MONEY - softer than expected. We read Instruction 001-01-2024 on payment services in the monetary union line by line. We found no requirement to host data in the region. It says all of the payment institution's data must be available at all times. It also requires security guarantees from outsourced providers. But it sets no rule about location. The older electronic money instruction, 008-05-2015, ties the registered office and the float account to the Union, not the servers. Rating for payments: yes, with paperwork. TELECOMS - the Electronic Communications Code of 2018 makes operators identify subscribers and keep communications confidential. It lets them hold technical data for up to two years. We found no duty to keep the data in Senegal. Rating: yes, with paperwork. HEALTH - we found no health-specific hosting rule. Health data counts as sensitive, and you need the regulator's permission before you use it. That is a permission barrier, not a location barrier. A dedicated digital health law was still being discussed in 2025 and had not been passed. GOVERNMENT - we found no binding hosting decree today. But two things point the same way. The national digital strategy commits to 100 percent of sensitive data being hosted in Senegal by 2034. And the critical infrastructure bill would make local hosting of public sector data compulsory. Rating today: yes, with paperwork. Rating if the bill passes: a copy must stay, or stricter. INSURANCE, SECURITIES, EDUCATION, GAMING, MAPPING AND DEFENCE - we found no data location rule on an official source. For insurance and securities, Senegal sits under two further regional bodies. We did not fully search their rulebooks, so both are listed as unconfirmed rather than cleared. For online gambling, the state lottery has been acting against unlicensed sites. That is about licensing, not data location.

Article 49 of Law 2008-12 bans sending data to another country unless that country ensures a sufficient level of protection. It also makes you tell the Commission before the transfer. Article 50 sets out exceptions. These cover transfers that are occasional and not bulk. They also cover transfers based on the person's consent or on carrying out a contract. And transfers based on a vital interest, a public interest or a legal claim. Article 51 lets the Commission approve a transfer to a country without sufficient protection. You have to apply with reasons and offer adequate safeguards for privacy. The Commission has never published a list of countries it considers safe enough. So the approved list exists on paper with nothing on it. That turns every transfer into one of two things. Either a self-assessment plus a filing, or a case-by-case application. There are no government standard contract templates in Senegal like the European ones. There is no certification route and no company-wide rules route. One useful anchor. Senegal became the fiftieth state to join the Council of Europe data protection convention, Convention 108. That convention is often used as the reference point for what 'sufficient protection' looks like.

Law 2008-12 sets up the CDP as an independent authority. It can warn you, order you to comply, suspend a permission for three months, and ban a use of data temporarily or permanently. It can also fine between 1 million and 100 million CFA francs, roughly 1,700 to 170,000 United States dollars. It must report any offences it finds to the public prosecutor. The evidence that it works is in its quarterly public activity notices. For January to March 2026 it reported 317 files handled. That included 286 declarations and 31 authorisation requests, 283 receipts issued, 27 authorisations granted, 9 complaints, 1 formal notice, 3 hearings and 1 refusal. It made an unannounced inspection of a private company on 12 March 2026 and ordered cameras removed from a meeting room. For October to December 2025 it reported 165 files, 14 complaints, 2 formal notices, and orders against face recognition clocking-in systems in hotels and clinics. The honest caveat. Almost all of this work is registration paperwork and video surveillance. We found no published decision imposing a money fine. So your real risk in Senegal is an order to stop doing something, plus damage to your reputation. It is not a large bill. Other bodies matter in their own areas. The telecoms regulator ARTP covers operators and subscriber identification. The Banking Commission of the West African Monetary Union covers banks.

MAXIMUM. Article 35 of Law 2008-12 says personal data must not be kept longer than you need it for the purposes you collected and used it for. Article 72 lets you keep data beyond that only for historical, statistical or scientific purposes. MINIMUMS. Senegal is a member of OHADA. That is the regional body that harmonises business law in West and Central Africa. Its uniform accounting act requires accounting books and supporting documents to be kept for ten years. Tax audit powers rest on the same records. In telecoms, the Electronic Communications Code allows technical data to be held for up to two years, subject to conditions. In banking, the outsourcing rules require records and archives to stay accessible for the periods the applicable rules set. They give no single number. WHICH RULE WINS. The data protection law gives way where another law requires you to keep data. Keeping data because a law obliges you to is a lawful reason. So the ten-year accounting minimum beats the general 'delete when done' maximum, for the documents it covers. What Senegal does not have is a published rulebook telling you how to separate the data you must keep from the data you must delete. That work falls on you.

There is almost nothing to report and no deadline to meet today. That is itself the finding. The 2008 data protection law was written before breach reporting became standard. It has no article on it. The only reporting duty in the law runs the other way. The regulator must report offences it learns of to the public prosecutor without delay. WHAT EXISTS AROUND THE EDGES. Banks and financial holding companies fall under general internal control and risk management circulars. Those require serious incidents to be escalated to the Banking Commission. We could not find a published deadline expressed in hours. Telecom operators have security and confidentiality duties under the Electronic Communications Code and answer to the telecoms regulator. Companies hit by cybercrime can go to the police cyber unit. That is a criminal complaint, not a report to a regulator. WHAT IS COMING. The national digital strategy commits to making organisations report any breach within a reasonable time. That signals a future legal duty. The critical information infrastructure and digital security bill would create a national cybersecurity authority, a national computer emergency response team and sector teams. Reporting incidents to those teams is the obvious next step. Neither is law today.

TRAP 1 - the filing duty is real and almost nobody does it. Under the 2008 law you must declare ordinary use of personal data to the regulator. It then issues a receipt. This has not quietly died. The regulator issued 283 receipts in the first quarter of 2026 alone. Operating without a receipt puts you in breach from day one, whatever else you get right. TRAP 2 - a second, tougher gate for the interesting data. Some uses need written permission first, not just a filing. Those are genetic data, health research, criminal offence data, linking separate databases, using the national identity number, and biometrics. Face recognition and fingerprint clocking-in systems sit squarely here. The regulator has ordered several of them switched off. TRAP 3 - cameras. Video surveillance dominates the regulator's caseload. It issued 200 receipts for businesses in one quarter. It also ordered cameras removed from meeting rooms, treatment rooms, kitchens and staff areas. A workplace camera rollout in Senegal is a regulatory project, not a facilities project. TRAP 4 - criminal liability. The 2008 law leaves punishment to the criminal code, as amended by the cybercrime law of the same date. It also makes the regulator pass offences to the prosecutor. So individuals are exposed, not just companies. TRAP 5 - a representative you actually have to appoint. A foreign company using equipment in Senegal must name a representative based in Senegal. There is no revenue threshold. There is no grace period in the text. TRAP 6 - for banks only, but expensive. An outsourcing contract must go to the banking supervisor to be assessed before you sign it. The supervisor expects your servers, or at least your backup servers, to be inside the West African monetary union.

IN THE NEXT TWELVE MONTHS. The critical information infrastructure and digital security bill. The Council of Ministers adopted it on 17 June 2026. It went to a joint parliamentary committee on 13 August 2026 and was adopted there. It now awaits the full sitting. Reported contents: a register of critical infrastructure, compulsory risk analysis, backup and encryption, resilience testing, and oversight of outsourced digital services. Also compulsory local hosting of public sector data, limits on relying on foreign cloud services, and a new national cybersecurity authority. Plus a national computer emergency response team and sector teams. Treat it as a proposal until the vote. Replacement of the 2008 data protection law. It has been discussed since 2020 and comes up again in the national digital strategy. That promises stronger confidentiality rules, informed consent, rules on data sharing, and breach reporting. No bill has been introduced. Do not plan around it. POWERS ALREADY HELD THAT COULD CHANGE THINGS WITHOUT WARNING. One. The regulator decides case by case, with no published criteria, which countries offer sufficient protection and which transfers are approved. It could tighten transfers tomorrow through refusals alone. No new law and no consultation would be needed. Two. The list of uses that need permission, rather than a simple filing, can be extended by regulation. Adding a category such as cloud hosting abroad would turn a filing into a permission overnight. Three. The national digital strategy already commits the state to hosting 100 percent of sensitive data in Senegal by 2034. Public contract terms and licence conditions can deliver that long before any law does. Those are not published as legislation. Four. Once the critical infrastructure bill passes, naming an operator as critical is expected to be an administrative decision. A private company could be pulled into the local hosting rules by a decision, not by a new law.