Senegal. Comprehensive data protection. Law
Law 2008-12Law No. 2008-12 of 25 January 2008 on the protection of personal data
In force
§1Summary
- Synopsis
Senegal's data protection law, one of the earliest in West Africa, following the French model. Processing must be declared to or authorised by the CDP.
- Key themes
- Unique features
Most processing must be declared to the CDP and sensitive categories (biometrics, national ID, criminal data) need prior authorisation. Members of the francophone DPA network (AFAPDP) are treated as adequate.
- SaaS relevance
SaaS providers processing data of Senegalese users through local customers will be swept into CDP declaration and transfer-notice formalities.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- Adequacy; inform CDP before transfer; derogations
- Maximum penalty
- Administrative XOF 100m; criminal up to 7 years and XOF 10m
§3Dates
- Key dates
- Adopted
- In force
- Implementing Decree 2008-721; reform bill presented January 2026 and still in legislative process (Oct 2026)
§4Text and authority
- Text
- Authoritative text cdp.sn
- Authority
- Commission de Protection des Données Personnelles (CDP)
§5Where it applies
- Domestic law of
- Senegal
§6Sources and verification
- Verification
High confidence.
Replacement law under development; monitor.