Burkina FasoPersonal Data Protection Law, rights of the data subject
Loi n°001-2021/AN, arts. 14, 16-17, 19-22 (droits de la personne concernée)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction, Consent
- Audit expectation
- none
What it requires
- Obtain a person's prior consent before sending them unsolicited direct marketing communications of any kind, tell them before their data is first used for that purpose or disclosed to a third party, and let them withdraw consent at any time.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
- Tell a data subject, no later than when you collect their data, your identity, the purposes of the processing, the categories of data, the recipients, the rights of access, rectification, erasure and objection, the retention period, any transfer abroad, and how to give or withdraw consent.NIST Privacy FrameworkCM.AW-P1
- Answer a data subject's access request by letting them consult their data on site or by giving them a copy after they prove their identity, and let a deceased adult's spouse, children or designated heir exercise that right on their behalf, or a minor's parent or legal representative exercise it for the minor, keeping the minor informed for medical data.NIST Privacy FrameworkCT.DM-P1
- Tell a data subject, on request, the information and reasoning behind a decision, automated or not, applied against them.NIST Privacy FrameworkCM.AW-P3
- Stop processing a person's data on their objection for legitimate reasons, unless you can show an overriding legitimate ground for the processing that outweighs their rights.NIST Privacy FrameworkCT.PO-P3
- Rectify, complete, update, lock or erase personal data at a data subject's written request within two months, notify any third party the data was disclosed to, and carry the burden of proof if you dispute the request.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Remove, on request, personal data about a person's past private life that was collected and made public on a website, whether or not it is indexed by a search engine.NIST Privacy FrameworkCT.DM-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CT.DM-P4Data elements can be accessed for deletion.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P3System/product/service design enables data processing visibility.
1 more
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
Logging duty
Article 21 requires a controller to justify to the person who asked, within two months of registering the request, that it carried out the rectification, completion, update, blocking or deletion and passed the changes to third parties who received the data, and puts the burden of proof on the controller in a dispute. The law names no log, but that justification cannot be given without a record of what was done and when. The data subject is the one entitled to the justification, and no audit or inspection is named in the cited articles. Article 14 bars direct marketing across the national territory without prior consent, which states where the ban runs rather than a test for the law's reach, so no hook value is coded; the cited articles carry no scope clause.
- Kind
- Implicit
- As of
- Provision
- Article 21, second and third paragraphs
- Trigger
- personal_data_processing
What this law does
Article 14 bars unsolicited direct marketing addressed to a person who has not given prior consent, and gives every person the right to be informed before their data is first used, disclosed to a third party, or used on a third party's behalf, and to be expressly asked for consent.
Article 16 requires the controller to proactively tell the data subject, no later than collection, its identity, the processing's purposes, the categories of data, the recipients, the rights of access, rectification, erasure and objection, the retention period, any transfer abroad, and how to give or withdraw consent, subject to a narrow exception for data collected to establish a state security, defense or public safety offense.
Article 17 gives the data subject a right of access by consultation or copy, lets a deceased adult's spouse, children or a designated heir exercise it unless the deceased objected to posthumous access to medical data, and lets a minor's parent or legal representative exercise it, directly or through a doctor for medical data, while keeping the minor informed.
Article 19 gives every person the right to know and contest the information and reasoning behind a decision, automated or not, applied against them. Article 20 gives a person the right to object to processing of their data for legitimate reasons, unless the controller shows an overriding legitimate ground.
Article 21 lets a person demand rectification, completion, updating, locking or erasure of inaccurate, incomplete, ambiguous, outdated or unlawfully processed data, requires the controller to justify compliance within two months and notify any third party the data reached, and puts the burden of proof on the controller if the request is disputed.
Article 22 gives a person a right to be forgotten, letting them obtain removal of personal data about their past private life that was collected and made public on a website, whether or not a search engine indexes it.
When LexLint raises it
When your app profile says your app sends automated outreach, serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .