Madagascar. Comprehensive data protection. Law
Law 2014-038Law No. 2014-038 on the protection of personal data
In force
Partly verified
Medium confidence.Adoption date from memory; in-force date from Data Protection Africa. [Link: Official CNLEGIS legislation portal]
§1Summary
- Synopsis
Madagascar's data protection law based on the French 1978 model, requiring prior declaration or authorisation of processing. Practical application awaits full operation of the CMIL and an implementing decree.
- Key themes
- Unique features
Fines up to 5% of prior-year pre-tax turnover; appointing a DPO exempts from declaration once CMIL operates.
- SaaS relevance
Low practical exposure today, but formal declaration and transfer-adequacy rules apply to SaaS processing Malagasy data.
§2Obligations
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- Adequacy or derogations; onward transfers need CMIL approval
- Maximum penalty
- 5% of prior-year pre-tax turnover; 6 months-2 years' imprisonment
§3Dates
- Key dates
- Adopted
- In force
- CMIL created by Decree 2023-1541 (Dec 2023); members partly appointed 2024; implementing decree pending
§4Text and authority
- Text
- Authoritative text cnlegis.gov.mg
- Authority
- Commission Malagasy sur l'Informatique et des Libertés (CMIL) – not yet fully operational
§5Where it applies
- Domestic law of
- Madagascar
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Adoption date from memory; in-force date from Data Protection Africa. [Link: Official CNLEGIS legislation portal]