Senegal

Article 2 of Law 2008-12 sets the scope. It covers processing carried out by a controller established in Senegal, and processing by a controller outside Senegal that uses means of processing located on Senegalese territory (other than means used only to route data through the country). In that second case the law says the controller must designate a representative established on Senegalese territory. What the 2008 text does not do is cover a purely foreign operator that merely targets Senegalese users from abroad with no local equipment. That gap is one of the main reasons a reform has been discussed since 2020. The regulator has not published a formal interpretation resolving it, so treat pure remote targeting as a grey area rather than a safe harbour.

SECTOR BY SECTOR, as checked on 19 August 2026. BANKING — the hard wall. Circular 04-2017/CB/C of the Banking Commission of the West African Monetary Union, in force since 2 July 2018, states that all of an institution's physical and electronic data must be available within the Union, and that the servers storing the data and hosting the applications must be in the Union; where the primary servers are not, backup servers within the Union are required. Every outsourcing contract must also be sent to the Banking Commission's Secretariat General for prior assessment. Senegal is a member of the Union, so this binds Senegalese banks and financial holding companies. Rating for banking: a copy must stay. CREDIT REPORTING — Instruction 009-06-2015 requires credit bureaus to place their backup media on a site located in another member state of the monetary union, which keeps the backups inside the bloc. Rating: a copy must stay. PAYMENTS AND ELECTRONIC MONEY — softer than expected. We read Instruction 001-01-2024 on payment services in the monetary union line by line and found no requirement to host data in the region. It requires all of the payment institution's data to be available at all times and requires security guarantees from outsourced providers, but no territorial rule. The older electronic money instruction, 008-05-2015, likewise ties the registered office and the float account to the Union, not the servers. Rating for payments: yes, with paperwork. TELECOMS — the Electronic Communications Code of 2018 imposes subscriber identification, confidentiality of communications and deferred retention of technical data for up to two years, but we found no obligation to keep the data in Senegal. Rating: yes, with paperwork. HEALTH — no health-specific hosting rule found. Health data is treated as sensitive and its processing needs the regulator's prior authorisation, which is a permission barrier, not a location barrier. A dedicated digital health law was still being discussed in 2025 and had not been passed. GOVERNMENT — no binding hosting decree found today, but two things point one way. The national digital strategy commits to 100 percent of sensitive data being hosted in Senegal by 2034, and the critical infrastructure bill would make local hosting of public sector data compulsory. Rating today: yes, with paperwork. Rating if the bill passes: a copy must stay, or stricter. INSURANCE, SECURITIES, EDUCATION, GAMING, MAPPING AND DEFENCE — no data location rule found on an official source. For insurance and securities, Senegal sits under two further regional bodies whose rulebooks we did not fully search; both are listed as unconfirmed rather than cleared. For online gambling, the state lottery has been acting against unlicensed sites, but on licensing grounds, not data location.

Article 49 of Law 2008-12 bars transfer to a third country unless that state ensures a sufficient level of protection, and requires the transfer to be notified to the Commission beforehand. Article 50 carves out transfers that are occasional and not bulk, and transfers based on the person's consent, the performance of a contract, a vital interest, a public interest or a legal claim. Article 51 lets the Commission authorise a transfer to a country without sufficient protection where the exporter offers adequate safeguards for privacy, on a reasoned application. Crucially the Commission has never published a list of countries it considers adequate, so the allowlist exists on paper with nothing on it. In practice that turns every transfer into either a self-assessment plus a filing, or a case-by-case application. There are no government standard contract templates in Senegal comparable to the European ones, and no certification or corporate binding rules route. One useful anchor: Senegal became the fiftieth state to accede to the Council of Europe data protection convention, Convention 108, which is often used as the reference point for what 'sufficient protection' looks like.

The CDP is established by Law 2008-12 as an independent authority, with power to warn, order compliance, suspend a permission for three months, ban a processing operation temporarily or permanently, and impose a financial penalty of between 1 million and 100 million CFA francs, roughly 1,700 to 170,000 United States dollars. It must also report offences it discovers to the public prosecutor. Evidence that it is operational, not paper: quarterly public activity notices. For January to March 2026 it reported 317 files processed, 286 declarations and 31 authorisation requests, 283 receipts issued, 27 authorisations granted, 9 complaints, 1 formal notice, 3 hearings and 1 refusal. It carried out an unannounced inspection of a private company on 12 March 2026 and ordered cameras removed from a meeting room. For October to December 2025 it reported 165 files, 14 complaints, 2 formal notices and orders against facial recognition clocking-in systems in hotels and clinics. The honest caveat: almost all of this activity is registration paperwork and video surveillance. We found no published decision imposing a monetary fine. So the practical risk in Senegal is an order to stop doing something, plus reputational exposure, more than a large bill. Other bodies matter in their own lanes: the telecoms regulator ARTP for operators and subscriber identification, and the Banking Commission of the West African Monetary Union for banks.

CEILING. Article 35 of Law 2008-12 says personal data must not be kept longer than the period necessary for the purposes for which it was collected and processed. Article 72 allows data to be kept beyond that period only where it is to be processed for historical, statistical or scientific purposes. FLOORS. Senegal is a member of OHADA, the regional organisation that harmonises business law in West and Central Africa, whose uniform accounting act requires accounting books and supporting documents to be kept for ten years. Tax audit powers rest on the same records. In telecoms, the Electronic Communications Code allows deferred retention of technical data for up to two years, subject to conditions. In banking, the outsourcing rules require the institution's records and archives to remain accessible for the periods set by the applicable regulations, without setting a single number. HOW A CONFLICT IS RESOLVED. The data protection law itself gives way where another law requires retention: keeping data because a statute obliges you to is a lawful basis, so the ten-year accounting floor beats the general 'delete when done' ceiling for the documents it covers. What Senegal does not have is a published rulebook telling you how to segregate the data you must keep from the data you must delete. That work falls on you.

Counting the clocks in Senegal is short work today, and that is itself the finding. The 2008 data protection law was written before breach notification became standard and contains no notification article. The only reporting duty in it runs the other way: the regulator must report offences it learns of to the public prosecutor without delay. What exists around the edges. Banks and financial holding companies are under general internal control and risk management circulars that require serious incidents to be escalated to the Banking Commission, but we could not locate a published notification deadline expressed in hours. Telecom operators have security and confidentiality duties under the Electronic Communications Code and answer to the telecoms regulator. Companies affected by cybercrime can go to the police cyber unit, which is a criminal complaint, not a regulatory notification. What is coming. The national digital strategy commits to requiring organisations to report any breach within a reasonable timeframe, which signals a future statutory duty. The critical information infrastructure and digital security bill would create a national cybersecurity authority, a national computer emergency response team and sector teams; incident reporting to those teams is the obvious next step. Neither is law today.

TRAP 1 — the filing regime is real and almost nobody does it. Under the 2008 law, ordinary processing must be declared to the regulator, which issues a receipt. This is not a formality that has quietly died: the regulator issued 283 receipts in the first quarter of 2026 alone. Operating without a receipt is a breach on day one, whatever else you get right. TRAP 2 — a second, tougher gate for the interesting data. Prior written authorisation, not just a filing, is needed for genetic data, health research, criminal offence data, linking separate databases, using the national identity number, and biometrics. Face recognition and fingerprint clocking-in systems fall squarely in here, and the regulator has ordered several of them switched off. TRAP 3 — cameras. Video surveillance dominates the regulator's caseload: 200 receipts for businesses in one quarter, plus orders to remove cameras from meeting rooms, treatment rooms, kitchens and staff areas. A workplace camera rollout in Senegal is a regulatory project, not a facilities project. TRAP 4 — criminal liability. The 2008 law hands the punishment of offences to the criminal code as amended by the cybercrime law of the same date, and obliges the regulator to pass offences to the prosecutor. That means individuals, not just companies, are exposed. TRAP 5 — a representative you have to actually appoint. A foreign company using equipment in Senegal must designate a representative established in Senegal. There is no revenue threshold, and no grace period written into the text. TRAP 6 — for banks only, but expensive: an outsourcing contract must go to the banking supervisor for assessment before you sign it, and the supervisor expects your servers, or at minimum your backup servers, to be inside the West African monetary union.

IN THE NEXT TWELVE MONTHS. The critical information infrastructure and digital security bill. Adopted by the Council of Ministers on 17 June 2026, presented to a joint parliamentary committee on 13 August 2026 and adopted there, awaiting the full sitting. Reported contents: a register of critical infrastructure, compulsory risk analysis, backup and encryption, resilience testing, oversight of outsourced digital services, mandatory local hosting of public sector data, restrictions on relying on foreign cloud services, and the creation of a national cybersecurity authority, a national computer emergency response team and sector teams. Treat it as a proposal until the vote. Replacement of the 2008 data protection law. Under discussion since 2020 and referred to again in the national digital strategy, which promises stronger confidentiality rules, informed consent, regulation of data sharing and breach reporting. No bill has been introduced. Do not plan around it. DORMANT SWITCHES — powers already held that could change the picture without warning. One. The regulator decides, case by case and with no published criteria, which countries offer sufficient protection and which transfers are authorised. It could tighten transfer practice tomorrow through refusals alone, with no new law and no consultation. Two. The list of processing operations needing prior authorisation, rather than a simple filing, can be extended by regulation. Adding a category, for instance cloud hosting abroad, would convert a filing into a permission overnight. Three. The national digital strategy already commits the state to 100 percent of sensitive data being hosted in Senegal by 2034. Procurement conditions and licence conditions can implement that long before any statute does, and are not published as legislation. Four. Once the critical infrastructure bill passes, designating an operator as critical is expected to be an administrative act. A private company could be brought inside the local hosting perimeter by a decision, not by a new law.