LexLint.ioBeta

Know the law your code answers to.

Law / Benin

Loi n°2017-20 portant Code du Numérique en République du Bénin, Livre V (protection des données à caractère personnel)

Loi n°2017-20 du 20 avril 2018 Livre V, Protection des Données à Caractère Personnelle, portant Code du Numérique en République du Bénin, arts. 379-390, 393, 405-414, 424-426 et 428-436 (principes généraux, licité et obligations des responsables de traitement)

In force.

A comprehensive regime rule binding public and private bodies.

How the hook was established
express
What makes it apply
Operator establishment, Market targeting, User location
Obligation class
Consent, Governance, Security, DPIA, Retention, Licensing
Audit expectation
on_request
Who audits it
Regulator
Where the report goes
Produced on request

What it requires

  • Obtain a lawful basis, ordinarily the data subject's consent, before collecting, processing, transmitting, storing, or using their personal data, unless a specific legal exception applies.NIST Privacy FrameworkCT.PO-P1
  • Collect personal data only for determined, explicit, and legitimate purposes, and do not process it further in a way incompatible with those purposes.NIST Privacy FrameworkGV.PO-P1
  • Keep personal data accurate, correct or erase inaccurate or incomplete data, and do not keep it in identifiable form beyond what its purpose requires.NIST Privacy FrameworkCT.PO-P2
  • Choose a processor offering sufficient security and confidentiality guarantees, fix the processor's obligations in a written contract, and ensure the processor acts only on your documented instructions.NIST Privacy FrameworkID.DE-P3
  • Where two or more controllers jointly determine the purposes and means of a processing, allocate your respective obligations toward data subjects in a transparent arrangement made available to them.NIST Privacy FrameworkGV.PO-P4
  • Declare each processing of personal data to the Autorité de Protection des Données Personnelles (APDP) before implementing it, or obtain the Autorité's prior authorization where the processing falls into one of its listed higher risk categories.NIST Privacy FrameworkGV.PO-P5
  • Implement data protection by design and by default, including pseudonymization and data minimization, so that only the personal data necessary to each specific purpose is processed by default.NIST Privacy FrameworkGV.PO-P2
  • Implement appropriate technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction, or damage, including pseudonymization and encryption where appropriate, and test their effectiveness regularly.NIST Privacy FrameworkPR.DS-P1NIST Privacy FrameworkCT.DM-P9
  • Carry out a data protection impact assessment before a processing likely to create a high risk to individuals' rights and freedoms, and consult the Autorité first where the assessment shows a risk you cannot mitigate.NIST Privacy FrameworkID.RA-P4
  • Designate a data protection officer where you are a public body, or your core activities require regular and systematic large scale monitoring or large scale processing of sensitive personal data, and publish that officer's contact details.NIST Privacy FrameworkGV.PO-P3
  • Keep a written record of your processing activities, covering the purposes, the categories of data subjects and data, the recipients, retention periods, and security measures, and make it available to the Autorité on request.NIST Privacy FrameworkID.IM-P4

These lines are LexLint's reading of the law's text. Also read by: Autorité de Protection des Données à caractère Personnel (APDP), Benin's data protection authority (guidance, recorded ).

In the frameworks

NIST Privacy Framework
  • ID.IM-P4Data actions of the systems/products/services are inventoried.
  • ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
  • ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
  • GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
  • GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
  • GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
6 more
  • GV.PO-P4Privacy roles and responsibilities are coordinated and aligned with third-party stakeholders (e.g., service providers, customers, partners).
  • GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
  • CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
  • CT.DM-P9Technical measures implemented to manage data processing are tested and assessed.
  • PR.DS-P1Data-at-rest are protected.
NIST CSF 2.0
  • GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
  • ID.AM-07Inventories of data and corresponding metadata for designated data types are maintained
  • PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
FINOS AIGF
7 more

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

Who enforces it

Settledness

As of
Guidance link
https://archive.apdp.bj/wp-content/uploads/2021/11/Fiche.Pratique.Mise-en-conformite_Pt_OK_Validee.pdf
Guidance body
Autorité de Protection des Données à caractère Personnel (APDP), Benin's data protection authority
Open questions
  • Does "à grande échelle" (on a large scale), the scale at which Article 430 requires a data protection officer for "un suivi régulier et systématique" (regular and systematic monitoring), carry a numeric or sectoral threshold fixed by the Autorité or a court?
  • Does the Article 407 category of automated processing capable "d'exclure des personnes du bénéfice d'un droit, d'une prestation ou d'un contrat" (of excluding persons from the benefit of a right, a service or a contract) reach a model-based scoring or moderation decision that denies a user access to a service, so that it needs the Autorité's prior authorization?

What it makes you log

Who may demand the log

Regulator

What the log must hold

Event time, Actor identity, Access record

Logging duty

Article 387, point 13 requires the controller to be able to establish afterwards the identity of the persons who had access to the information system, the nature of the data entered, altered, copied, erased or read, and the moment of each operation, which is an access trail. Article 435 adds a written register of processing activities for each controller and processor, which they make available to the Autorité on request; the register's contents (purposes, categories of persons and data, recipients, transfers, erasure periods, a general description of security measures) are not log fields, and small and medium enterprises are exempt unless the processing risks harm, is not occasional or concerns sensitive data. Article 387 also has the controller draw up an annual report for the Autorité on compliance with its measures, which is the controller's own report. Article 390 makes the controller able to demonstrate consent but names no record, and Article 433 limits how long the personal data are kept, not a log. No clause sets a period for keeping the trail or the register. The territorial clause in Article 381 also reaches processing carried out on the territory of an ECOWAS member State and processing by a controller established where Benin law applies under public international law; those prongs turn on where the processing happens.

Kind
Explicit
As of
Provision
Article 387, point 13 (the controller must ensure that who accessed the information system, what data were entered, altered, copied, erased or read, and when, can be verified afterwards), with Article 435 (a written register of processing activities made available to the Autorité on request)
Trigger
personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Benin's comprehensive personal-data statute, deliberated and adopted by the National Assembly on and promulgated by the President on after two Constitutional Court conformity decisions, repealing the earlier Loi n°2009-09 du 24 mai 2009.

Articles 379 to 382 set the Book's object and its material and territorial scope, reaching collection, processing, transmission, storage, and use of personal data by a natural person, the State, local governments, and other public or private bodies, subject only to a narrow exclusion for purely personal or domestic processing not intended for communication or diffusion to third parties.

Article 383 requires personal data to be processed lawfully, fairly, and transparently, for determined and legitimate purposes, kept accurate, and retained no longer than those purposes require. Articles 384 and 385 add the transparency and confidentiality and security principles that run through the rest of the Book.

Article 386 requires a controller to choose a processor offering sufficient security and confidentiality guarantees and to fix the processor's obligations in a written contract, Article 387 lists the controller's own accountability duties, and Article 388 requires joint controllers to allocate their respective obligations by a transparent arrangement made available to data subjects.

Articles 389 and 390 make consent the ordinary basis for lawful processing, subject to exceptions for a legal obligation, a public interest task, a contract, or safeguarding vital interests, and set the conditions a valid consent must meet, including that it be freely given, specific, and withdrawable at any time. Article 393 requires that any interconnection of files serve a legitimate legal or statutory objective and respect the relevance of the data interconnected.

Articles 405 to 414 require a controller to declare each processing to the Autorité de Protection des Données Personnelles (APDP) before implementing it, or to obtain the Autorité's prior authorization for the higher risk categories it lists, subject to the simplified declarations and exemptions the Autorité may grant.

Article 424 requires data protection by design and by default, including pseudonymization and data minimization, so that only the data necessary to a specific purpose is processed by default. Articles 425 and 426 require confidential processing and appropriate technical and organizational security measures, including pseudonymization, encryption, and regular testing of their effectiveness.

Articles 428 and 429 require a data protection impact assessment before a processing likely to create a high risk to individuals' rights and freedoms, followed by prior consultation with the Autorité where the risk cannot be mitigated. Articles 430 to 432 require a data protection officer for a public body, or for large scale monitoring or large scale sensitive data processing, and set that officer's independence and functions.

Article 433 bars keeping personal data in identifiable form beyond what its purpose requires, and Article 435 requires a written record of processing activities available to the Autorité on request. The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .