What Is Law No. 2013-015 of 21 May 2013 on the Protection of Personal Data?
Mali's Law No. 2013-015 of 21 May 2013 applies to personal-data processing carried out wholly or partly in Mali by the State, territorial authorities, public bodies, and private persons, subject to its stated exclusions. Law No. 2017-070 of 18 December 2017 later amended several articles governing the APDP's composition and institutional functioning. The law creates the Autorité de Protection des Données à Caractère Personnel (APDP) to coordinate and control personal-data processing nationally. It provides a free access right, a correction/completion/updating/blocking/deletion right for data that is inaccurate, incomplete, or unlawfully retained (30-day controller response), and an objection right, including a free objection before first use for third-party prospecting. This is a source-backed evidence profile. The official legal materials are in French; no official English translation was located, so French terminology controls. No Mali-specific data-broker or people-search opt-out route was located.
At a glance
- Full name
- Law No. 2013-015 of 21 May 2013 on the Protection of Personal Data
- Short code
- Mali Law 2013-015
- Jurisdiction
- Mali
- Enacted
- 2013
- Last major update
- Amended by Law No. 2017-070 of 18 December 2017 (APDP institutional provisions); current APDP activity in 2026 continues to cite the amended Law No. 2013-015, and no later amendment was located in the 9 October 2026 review
- Regulator
- Autorité de Protection des Données à Caractère Personnel (APDP)
- Private right of action
- Limited
Scope, who Mali Law 2013-015 covers
Protected data
Data subject rights
Access to all data concerning the person and available origin information, free and without delay (Article 12)
Correction, completion, updating, blocking, or deletion of inaccurate, incomplete, outdated, or unlawfully retained data, free within 30 days of a written request (Article 13)
Information at collection about the controller, purpose, and the right to object to appearing in the file (Article 15)
Free objection for legitimate reasons, and a free, express objection before first third-party disclosure or prospecting use (Article 19)
Notable features
Article 68 gave existing processors already active at promulgation up to six months to come into compliance. The APDP publishes an online complaint form and a treatment repertoire (register of processing activities), updated July 2024.
Enforcement & penalties
Regulator: Autorité de Protection des Données à Caractère Personnel (APDP)
Penalties: The reviewed official law text and APDP materials for this research pass did not surface a consolidated penalty schedule; verify current sanction amounts against the APDP norms and Journal Officiel before publication.
Private right of action: The APDP receives and investigates complaints under Article 34 via an online form; the reviewed sources describe a regulatory complaint route rather than a separate civil damages action.
Relevance to data brokers
No Mali-specific commercial data-broker registry or people-search removal route was located. For a controller processing data in Mali, the located route is a written request under Article 13, followed by an APDP complaint under Article 34 if unresolved.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
What language controls Mali’s data-protection law?+
The official text is in French; no official English translation was located, so French terminology should control any translated summary.
How long does a Malian controller have to act on a correction or deletion request?+
Article 13 requires the controller to justify, free of charge, that it completed the requested operation within 30 days after the request is recorded.
Official sources & citations
Other international privacy regimes
Mali Law 2013-015 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: