Burkina FasoPersonal Data Protection Law, supervisory authority and sanctions
Loi n°001-2021/AN, arts. 45-79 (autorité de contrôle et sanctions)
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Commission de l'informatique et des libertés (CIL), an independent administrative authority of nine members, to issue individual or regulatory decisions, warnings and referrals to the public prosecutor, and to receive complaints and petitions from data subjects.
- Cooperate with a CIL verification or control mission on site, including any expert it brings, and pay the mission's costs yourself if you were the one who requested the control.
- Take all useful measures to facilitate the CIL's mission, and do not obstruct its action for any reason.
- Expect a data subject or their representative to be able to seek urgent court relief for a serious and immediate violation of their rights, and to seek damages for the moral or material harm they suffered.
- Expect the CIL to pronounce a forfeitary fine of one percent of your prior year's tax-exclusive turnover for a first violation, rising to five percent for a repeat violation, on top of the fixed-range fines, confiscation, publication or activity-ban penalties it may add, and expect a violation of this law to be punished under the Penal Code's information-technology offense provisions.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 79 refers violations of this law to the Penal Code's own provisions on information-technology and communications-technology offenses, rather than stating a criminal amount in this law itself. Article 75 separately sets a reduced administrative fine of two million to five million francs CFA for an unauthorized disclosure of personal data caused by imprudence or negligence, the law's only breach-adjacent provision.
Penalty structure
Art. 65 sets the CIL's general forfeitary fine (l'amende forfaitaire) at 1% of the controller's prior-year, tax-exclusive turnover for a first violation, rising to 5% for a repeat violation, proportioned to the gravity of the breach and the advantage gained from it. The same Title IV, Chapter 1 also lists a separate schedule of fixed-range fines the CIL may pronounce for specific enumerated violations (Arts. 67 to 75), running from 1,000,000 to 100,000,000 CFA francs depending on the violation (for example, 5,000,000 to 100,000,000 francs for diverting the purpose of a collection, and 2,000,000 to 5,000,000 francs for an unauthorized disclosure caused by imprudence or negligence); the law's own text does not state how that fixed-range schedule relates to the Art. 65 percentage formula.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 5
Who enforces it
Enforcement body
Commission de l'informatique et des libertés (CIL), an independent administrative authority of nine members created by the law
Settledness
- As of
- Open questions
- Does the Article 65 forfeitary fine of one percent of turnover, or five percent on a repeat violation, apply in place of or in addition to the fixed-range fines of Articles 67 to 75?
- Does "récidive" in Article 65 require an earlier CIL decision against the same controller, and within what period must the repeat violation fall?
What it reaches
Obligation class
Governance, Reporting
Applicability criteria
Criteria are an English rendering of Article 3 of the Law, which is in French.
- As of
- Combinator
- Any of
- Criteria
- the controller of the processing is established in Burkina Faso, wherever the processing is carried out
- without being established in Burkina Faso, the controller comes under Burkina Faso according to public international law
- a controller or processor not established in the territory of Burkina Faso carries out processing operations from the national territory, excluding transit data
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 57 lets the CIL, when it needs to, send its members, agents and experts to carry out on-site verifications and checks of any processing, and Article 67 fines a controller that withholds or conceals the information and documents useful to that mission, or that supplies information not matching the content of the recordings as they stood when the request was made or not presented in directly intelligible form. The law does not tell the controller to keep a log, but answering a verification from the recordings requires them to exist. The checks happen at the CIL's initiative, with no fixed schedule, and the cited articles carry no territorial clause (Article 78 extends the sanctions to every file whose use is not exclusively private, which is a subject-matter rule).
- Kind
- Implicit
- As of
- Provision
- Articles 57 and 67
- Trigger
- personal_data_processing
What this law does
Article 45 creates the Commission de l'informatique et des libertés (CIL) as an independent administrative authority with administrative and management autonomy, charged with policing the use of information and communication technologies in personal data processing.
Article 46 sets the CIL's composition at nine members drawn from the Conseil d'Etat, the Cour de Cassation, the National Assembly, human-rights associations, information-technology professional associations, and the President of Faso.
Articles 47 to 55 fix the members' five-year renewable mandate, their irremovability except on listed grounds, the President's status and permanent duties, incompatibilities with government office or a technology-industry role, an oath before the Ouagadougou Court of Appeal, their functional immunity, and the CIL's budget and financing rules, including a bar on borrowed funds.
Article 56 lists the CIL's attributions, including issuing individual and regulatory decisions and sector recommendations, ordering exceptional security measures, warning offenders and referring infractions to the public prosecutor, receiving complaints and petitions, authorizing foreign transfers, and advising public authorities and the government.
Article 57 lets the CIL send members, agents or experts to verify and control any processing on site, and Article 58 bars anyone the CIL is investigating from obstructing its action. Article 61 requires the CIL to submit an annual public report on its mission to the President of Faso and the President of the National Assembly.
Article 63 lists the CIL's administrative sanctions: a warning, a formal notice, an order to stop the processing, the locking of certain data, a forfeitary fine, and withdrawal of authorization. Article 65 sets that forfeitary fine at one percent of the controller's tax-exclusive turnover for the last closed financial year on a first violation, rising to five percent on a repeat violation, proportioned to the gravity of the breach and the advantage gained from it.
Article 66 lets the CIL's president or a person whose rights are violated seek urgent court relief for a serious and immediate violation, and lets a data subject or their representative seek damages for the moral or material harm suffered.
Articles 67 to 75 set a schedule of fixed-range fines for specific violations, running from one million to one hundred million francs CFA depending on the violation, including a reduced fine for an unauthorized disclosure caused by imprudence or negligence, though the act's own text does not state how this fixed-range schedule relates to the Article 65 percentage formula.
Article 76 lets the CIL confiscate or order the erasure of the data's physical media and bar a sanctioned controller from managing any processing for up to two years, and Article 77 lets it order publication of its decision at the offender's expense. Article 79 refers violations of the act to the Penal Code's own provisions on information-technology and communications-technology offenses.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .