What Is Loi n°001-2021/AN on the protection of personal data?
Loi n°001-2021/AN was adopted on 30 March 2021 and promulgated on 15 April 2021, expressly repealing the 2004 law. The CIL continues to publish and apply the 2021 framework, including in 2026. Currentness is unsettled. The Presidency reported in November 2025 that the Government had adopted a project modifying the data-protection law and creating ARCOD, and the Assemblée législative reported that both projects were adopted on 3 August 2026. No promulgated or Journal Officiel text for those projects was located in the official sources searched. The operative framework covers automated and non-automated processing in files, including electronic communications. It provides information, access, indirect access through the CIL for specified public-security processing, explanation and challenge, opposition, rectification, completion, updating, locking, deletion, and a right to be forgotten. No express general data-portability right was located in the statutory rights provisions.
At a glance
- Full name
- Loi n°001-2021/AN on the protection of personal data
- Short code
- Loi n°001-2021/AN
- Jurisdiction
- Burkina Faso
- Enacted
- 2021
- Last major update
- Adopted 30 March 2021 and promulgated 15 April 2021; replacement data-protection and ARCOD projects were reported adopted on 3 August 2026, but no promulgated or Journal Officiel text was located
- Regulator
- Commission de l’Informatique et des Libertés (CIL)
- Private right of action
- Yes
- Statutory citation
- Loi n°001-2021/AN
Scope, who Loi n°001-2021/AN covers
Protected data
Data subject rights
Right to information about the controller or representative, purposes, data categories, mandatory or optional responses, recipients, retention, foreign transfers, and access, rectification, deletion, and opposition mechanisms
Right of access to consultation or a copy of personal data, subject to identity verification and statutory special rules
Right to indirect access through the CIL for State-security, defence, public-security, intelligence, judicial-police, and administrative-police processing
Right to know and contest information and reasoning used in automated or non-automated processing whose results oppose the person
Right to oppose processing for legitimate reasons, subject to overriding legitimate grounds demonstrated by the controller
Right to rectification, completion, updating, locking, and deletion of inaccurate, incomplete, ambiguous, obsolete, or unlawfully processed data
Right to be forgotten for personal data relating to private life or past activities made public on a website
No express general statutory right to data portability was located in Articles 16–22
Right to complain to the CIL and seek judicial escalation or compensation in appropriate circumstances
Notable features
The framework combines GDPR-style information, access, correction, deletion, opposition, and right-to-be-forgotten provisions with CIL authorisation and enforcement powers. Currentness remains unsettled because replacement law and ARCOD projects were reported adopted in August 2026, but no promulgated or Journal Officiel text was located.
Enforcement & penalties
Regulator: Commission de l’Informatique et des Libertés (CIL)
Penalties: Administrative sanctions include warning, formal notice, an order to cease processing, data locking, a fixed fine, and withdrawal of authorisation. The fixed fine is 1% of prior-year pre-tax turnover for a first breach and 5% for repeat offending. Statutory ranges include 5–10 million FCFA for CIL obstruction; 5–20 million FCFA for failure to complete prior formalities or security failure; 1–10 million FCFA for unauthorised access or disclosure; 5–100 million FCFA for purpose diversion or fraudulent, unfair, or unlawful collection; 10–100 million FCFA for unauthorised sensitive, offence, conviction, or security data. The CIL may also order confiscation or erasure, prohibit management of personal-data processing for up to two years, and publish the sanction.
Private right of action: Serious and immediate harm may support référé proceedings and compensation claims. CIL sanction decisions may be challenged before the competent administrative court. No general standalone compensation schedule was located.
Relevance to data brokers
A data broker would potentially be a private controller subject to ordinary access, rectification, deletion, opposition, and right-to-be-forgotten provisions, with complaints made through the generic CIL process. No named data-broker registry, broker-specific opt-out route, public-record correction route, or public-record deletion procedure was located.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does Burkina Faso currently have a comprehensive data-protection law?+
The 2021 data-protection law remains the operative framework identified by the CIL, but currentness is unsettled. Reform projects were reported adopted on 3 August 2026, while no promulgated or Journal Officiel text for those projects was located.
What privacy rights exist under Burkina Faso’s 2021 law?+
The law provides information, access, indirect access through the CIL for specified sensitive public processing, explanation and challenge, opposition, rectification, completion, updating, locking, deletion, and a right to be forgotten. No express general statutory right to data portability was located.
Does Burkina Faso have a data-broker deletion route?+
No named data-broker registry, broker-specific opt-out route, public-record correction route, or public-record deletion procedure was located. A broker would potentially be subject to the ordinary controller rights and generic CIL complaint process.
Official sources & citations
Other international privacy regimes
Loi n°001-2021/AN sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: