Burkina FasoLoi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel
Loi n°001-2021/AN du 30 mars 2021 portant protection des personnes à l'égard du traitement des données à caractère personnel arts. 1-11, 13, 23-41 (dispositions générales, principes fondamentaux, obligations du responsable et formalités préalables)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Security, Retention, Governance, Licensing
- Audit expectation
- none
What it requires
- Obtain the data subject's prior consent before processing their personal data, unless a specific legal exception applies, such as performing a contract, complying with a legal obligation, protecting a vital interest, or a public interest ground.NIST Privacy FrameworkCT.PO-P1
- Collect personal data only for determined, explicit and legitimate purposes, keep it accurate and updated, and do not retain it beyond the period the purpose requires.NIST Privacy FrameworkGV.PO-P1NIST Privacy FrameworkCT.PO-P2
- Implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access.NIST Privacy FrameworkPR.DS-P5
- Before using a processor, choose one that offers sufficient guarantees of protection, and sign a written agreement with it fixing the processing operations it may carry out and what happens to the data when the contract ends.NIST Privacy FrameworkID.DE-P3
- Complete the applicable prior formality with the Commission de l'informatique et des libertés (CIL) before processing personal data, a normal or simplified declaration, a request for its opinion, or its authorization depending on the category of processing.NIST Privacy FrameworkGV.PO-P5
- Obtain a CIL authorization before interconnecting personal data files or processing a national identification number, and limit any interconnection to a legitimate legal or statutory objective without discriminating against or reducing the rights of the people concerned.NIST Privacy FrameworkGV.PO-P5
- Obtain the CIL's authorization, given after the Health Research Ethics Committee's concurring opinion, before processing personal data for health research, anonymize the data before transmission wherever the research's purpose allows it, and host any health data that still permits identification on national territory.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkCT.DP-P2NIST Privacy FrameworkID.IM-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P7The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a controller or processor "non établi sur le territoire du Burkina Faso" (not established in the territory of Burkina Faso) come within Article 3 when its only link is that it collects personal data about people in Burkina Faso over the internet from servers abroad, or does the text require operations carried out "à partir du territoire national" (from the national territory) itself?
- Does the Article 3 carve-out for "données de transit" (transit data) exclude a service that receives personal data from abroad and relays or caches it for people in Burkina Faso?
What it makes you log
Logging duty
The cited articles set the principles, the security and processor duties, the consent rule and the prior-formality regime. Article 10 requires technical and organizational security measures but asks for no log or record of them, Article 11 requires a processing agreement with a processor rather than a record, and the declarations and authorizations of Articles 26 to 33 are filings made to the CIL, not records the controller keeps. Article 25 limits how long the data are kept, which concerns the data, not a log. The territorial hook is the establishment prong of Article 3, first paragraph. The second paragraph of Article 3 also reaches a controller or processor not established in Burkina Faso that carries out processing operations from its territory; that prong turns on where the operations are run, so it is left out of the hook value.
- Kind
- None
- As of
What this law does
Article 1 states the act's purpose as protecting a natural person's fundamental rights and freedoms in the processing of their personal data. Articles 2 and 3 apply it to automated and non-automated processing alike, including electronic communications data, and bind a controller established in Burkina Faso or one processing from Burkina Faso's territory without being established there.
Article 4 excludes only purely personal or domestic activity, temporary technical transit copies, and journalism carried out under professional ethical rules, leaving publicly available personal data within scope. Articles 6 and 7 require collection, recording, processing, storage and transmission to be lawful, fair and non-fraudulent.
Article 8 limits processing to the determined, explicit and legitimate purposes the data were collected for, and Article 9 requires collected data to be accurate and, where necessary, updated. Article 10 requires the controller to implement appropriate technical and organizational measures to preserve the security and confidentiality of the data, including protection against accidental or unlawful destruction, loss, alteration, disclosure or unauthorized access.
Article 11 requires a controller that uses a processor to choose one offering sufficient guarantees of protection and to sign an agreement fixing the authorized processing operations and the data's fate at the end of the contract.
Article 13 requires the controller's prior consent for processing, subject to exceptions covering manifestly public data, a vital interest, medical care, a court proceeding, a public interest ground, contractual necessity, a legal obligation, a public authority's mission, and a non-profit organization's activities limited to its own members.
Articles 23 to 25 hold every person handling the data to the controller's or processor's authority and instructions, and bound retention to the processing's purpose subject to an archival, historical, statistical or research exception the CIL approves.
Articles 26 to 33 set the prior-formality regime of a normal declaration, a simplified declaration, a request for the CIL's opinion, or its authorization depending on the category of processing, and let a controller optionally designate a data protection officer.
Articles 30 and 31 require a legislative or regulatory act taken after the CIL's opinion before a public body processes data for state security, criminal justice, the census, or payroll and tax administration, and a CIL authorization before interconnecting personal data files or processing a national identification number. Article 41 bounds any interconnection to a legitimate legal or statutory objective that does not discriminate against or reduce the rights of the people concerned.
Articles 36 and 37 require the CIL's authorization, given after the Health Research Ethics Committee's concurring opinion, before processing personal data for health research, anonymization of the data before transmission wherever the research's purpose allows it, and national hosting of any health data that still permits identification.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .