What Is Law No. 2017-020 of 22 July 2017 on the Protection of Personal Data?
Mauritania's Law No. 2017-020 of 22 July 2017, published in Journal Officiel issue No. 1400 (15 November 2017), covers personal-data processing by individuals, the State, local authorities, and public- or private-law legal persons, including a controller established or operating with processing means in Mauritania. Article 64 creates the Autorité de Protection des Données à caractère personnel (APD) as an independent public body responsible for supervision, guidance, complaint-handling, and sanctions. Individual rights include a written access request (Articles 53–58), a free objection right except where processing responds to a legal obligation (Article 59), and rectification/completion/update/lock/deletion of inaccurate or unlawfully retained data, with a controller response required within one month (Articles 61–63). A respondent entity has 15 days to submit observations once the APD takes up a complaint. This is a source-backed evidence profile. The primary text is French; no official English translation was located. No Mauritania-specific data-broker registry or public-record suppression route was located.
At a glance
- Full name
- Law No. 2017-020 of 22 July 2017 on the Protection of Personal Data
- Short code
- Mauritania Law 2017-020
- Jurisdiction
- Mauritania
- Enacted
- 2017
- Last major update
- No amending law located in the 9 October 2026 review; APD 2026 deliberations continue to apply Law No. 2017-020, while the 23 October 2023 internal regulation and Decree No. 2022-013 govern the APD’s operation
- Regulator
- Autorité de Protection des Données à caractère personnel (APD)
- Private right of action
- Limited
- Statutory citation
- Law No. 2017-020 of 22 July 2017
Scope, who Mauritania Law 2017-020 covers
Protected data
Data subject rights
Written access request for confirmation of processing, accessible data, purposes, categories, recipients, and third-country transfers, with a copy on request (Articles 53–58)
Free objection to processing, except where processing responds to a legal obligation (Article 59)
Free, informed objection before first third-party disclosure or prospecting use (Article 60)
Rectification, completion, updating, locking, or deletion of inaccurate, incomplete, outdated, or unlawfully retained data, with a one-month controller response window (Articles 61–63)
Notable features
Article 99 gave State/public-service processing three years and other controllers two years to comply from the law’s entry into force and the APD’s effective establishment. The APD publishes a dedicated online complaint form and contact address.
Enforcement & penalties
Regulator: Autorité de Protection des Données à caractère personnel (APD)
Penalties: The reviewed APD materials for this research pass did not surface a consolidated administrative-fine schedule; check the APD’s current sanctions guidance before publishing a penalty figure.
Private right of action: The APD receives complaints via a public form under Article 73(2)(b); its internal regulation gives a respondent entity 15 days to respond, after which the APD may seek an amicable solution, issue observations, investigate, or refer the matter to the prosecutor. The reviewed sources describe this regulatory route rather than a separate civil damages action.
Relevance to data brokers
No Mauritania-specific data-broker registry or public-record suppression mechanism was located. The located general routes for a broker processing data within scope are a written access, rectification, or objection request, followed by an APD complaint; entity-specific and public-record exceptions require separate legal review.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
How long does a Mauritanian controller have to act on a rectification or deletion request?+
Article 62 requires the controller to justify, free of charge, that the required operation was completed within one month of registering the request.
Who enforces Mauritania’s data-protection law?+
The Autorité de Protection des Données à caractère personnel (APD), an independent public body created by Article 64, supervises compliance and handles complaints via its online form.
Official sources & citations
Other international privacy regimes
Mauritania Law 2017-020 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: