Mali. Comprehensive data protection. Law

Law 2013-015Law No. 2013-015 of 21 May 2013 on the protection of personal data

In force

Partly verified

Medium confidence. Breach/DPO/penalty details not verified. [Link: Journal officiel 2013 no. 26 (SGG Mali), p.1002]

§1Summary

Synopsis

Mali's data protection law, establishing the APDP and a declaration/authorisation system for processing. The APDP is actively enforcing, including publishing lists of sanctioned organisations.

Key themes

declaration
authorisation
data subject rights
enforcement
cross-border transfers

Unique features

APDP publicly names non-compliant organisations and issued a XOF 5m fine in 2025 for reporting failures and obstruction.

SaaS relevance

SaaS providers working with Malian organisations should expect declaration and transfer formalities enforced by an active APDP.

§2Obligations

Cross-border transfers: Adequacy-based

§3Dates

Key dates

Adopted 21 May 2013
In force 2013
Amended by Law 2017-070 of 18 Dec 2017 (authority functioning); APDP operational 2016; fines issued 2025

§4Text and authority

Text

Authoritative text sgg-mali.ml

Authority

Autorité de Protection des Données à caractère Personnel (APDP)

§5Where it applies

Domestic law of: Mali

§6Sources and verification

Verification

Medium confidence.

Partly verified

Medium confidence. Breach/DPO/penalty details not verified. [Link: Journal officiel 2013 no. 26 (SGG Mali), p.1002]