What Is Law No. 2008-12 of 25 January 2008 on Personal Data Protection?
Senegal’s primary privacy statute is Law No. 2008-12 of 25 January 2008 on personal data protection. It was published in Journal Officiel No. 6406 on 3 May 2008, and Article 5 creates the independent Commission de Protection des Données à Caractère Personnel. Decree No. 2008-721 of 30 June 2008 is the implementing instrument. No official instrument amending Law 2008-12 itself, and no official consolidated amended edition, was located. Law No. 2016-29 amended the Penal Code and is relevant to criminal data-protection offenses, but it is not an amendment to Law 2008-12 itself. The law provides general controller rights and CDP oversight, but no Senegal-specific data-broker complaint route, public-record deletion portal, or special broker-removal procedure was located.
At a glance
- Full name
- Law No. 2008-12 of 25 January 2008 on Personal Data Protection
- Short code
- Law No. 2008-12
- Jurisdiction
- Senegal
- Enacted
- 2008
- Last major update
- No official instrument amending Law 2008-12 itself, and no official consolidated amended edition, was located. Law No. 2016-29 amended the Penal Code but is not an amendment to Law 2008-12 itself.
- Regulator
- Commission de Protection des Données à Caractère Personnel (CDP)
- Private right of action
- Limited
- Statutory citation
- Law No. 2008-12 of 25 January 2008 on Personal Data Protection
Scope, who Law No. 2008-12 covers
Protected data
Data subject rights
Right to information about the controller, purposes, data categories, recipients, mandatory or optional responses, retention, foreign transfers, and the ability to request file removal
Right of access through an identity-proven written request, including confirmation of processing, copies, data origin, purposes, categories, recipients, and contemplated third-country transfers
Right to indirect access through a CDP-supervised procedure for security, defense, and public-security files
Right to object on legitimate grounds
Right to object free of charge before first third-party disclosure or prospecting use, except where legally required
Right to rectification, completion, updating, blocking, and suppression of inaccurate, incomplete, ambiguous, outdated, or unlawfully handled data
Right to confirmation of a rectification or suppression request within 1 month, with third-party notification
Protection against solely automated decisions with legal effects, subject to statutory exceptions
Right to protection against direct marketing without prior consent
Right to submit a complaint, petition, or claim to CDP personally, through counsel, or through a duly authorized representative
Notable features
Senegal has a dual administrative and criminal enforcement structure: CDP may impose administrative fines and authorization measures, while Penal Code Articles 431-19–431-28 address criminal offenses. The law’s controlling text is the French Journal Officiel version; CDP states that normative texts are authoritative only in that published version. The currentness status remains open because no official consolidated amended edition or amendment to Law 2008-12 itself was located.
Enforcement & penalties
Regulator: Commission de Protection des Données à Caractère Personnel (CDP)
Penalties: Article 30 permits an administrative fine of 1,000,000-100,000,000 CFA francs after formal notice and an adversarial procedure. CDP may also provisionally withdraw an authorization for 3 months, after which the withdrawal becomes definitive. Criminal offenses under Penal Code Articles 431-19–431-28, as amended by Law No. 2016-29, generally carry 1-7 years’ imprisonment and 500,000-10,000,000 CFA francs, or either alone, for unlawful collection, defiance of an objection, unlawful processing of sensitive data, excessive retention, or purpose diversion. The negligence variant for unlawful disclosure carries 6 months-5 years and 300,000-5,000,000 CFA francs. Obstructing CDP carries 6 months-2 years and 200,000-1,000,000 CFA francs.
Private right of action: The general Articles 68-69 controller-rights route and CDP complaints are the identified mechanisms. CDP decisions are appealable before the Conseil d’État. No separate broker-specific judicial route or general private damages mechanism was located in the reviewed report.
Relevance to data brokers
No Senegal-specific data-broker complaint route, public-record deletion portal, or special broker-removal procedure was located across the reviewed CDP legislation, rights, obligations, formalities, missions, contact, publications, and official Journal Officiel materials. The available route is the general Articles 68-69 controller-rights process plus a CDP complaint where necessary; CDP currently publishes a dedicated complaint-and-reporting page for complaints concerning personal-data processing.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Is there an official consolidated amended text of Senegal’s privacy law?+
No official consolidated amended edition was located. No official instrument amending Law 2008-12 itself was located, although Law No. 2016-29 amended the Penal Code and is relevant to criminal data-protection offenses.
Does Senegal have a dedicated data-broker removal procedure?+
Not located. The available mechanisms are the general Articles 68-69 controller rights and a complaint to CDP where necessary.
Where can a person complain about personal-data processing?+
CDP currently publishes a complaint-and-reporting page for complaints concerning personal-data processing. This is a general CDP route, not a Senegal-specific data-broker deletion procedure.
How long does CDP have to resolve a privacy complaint?+
No fixed statutory deadline for CDP complaint processing or resolution was located. The 1-month period concerns controller rectification or suppression, while the 2-month period concerns CDP opinions or authorizations, not complaints.
Official sources & citations
Other international privacy regimes
Law No. 2008-12 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: