Law No. 2013-450 on the Protection of Personal Data

Loi n° 2013-450 du 19 juin 2013 relative à la protection des données à caractère personnel arts. 1-20, 22, 27, 39-44 (lawful basis, registration and security)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived February 18, 2026. Publisher's page: https://www.artci.ci/images/stories/pdf-english/lois_english/loi_2013_450_english.pdf

In force.

A comprehensive regime rule binding public and private bodies.

Obligation class: Consent, Disclosure, Governance, Security, Retention
Audit expectation: periodic
Who audits it: Self
Where the report goes: Filed with regulator

What it requires

Have a lawful basis, such as the person's express consent, before collecting, transmitting, storing or using anyone's personal data, whether the processing is automated or not.NIST Privacy FrameworkCT.PO-P1
Declare the processing to ARTCI in advance, or designate an internal correspondent for the protection of personal data in its place, except before a cross-border transfer.NIST Privacy FrameworkGV.PO-P5
Obtain ARTCI's prior authorization before processing on a national identification number or a personal-data set of public-interest, historical or scientific research value.NIST Privacy FrameworkGV.PO-P5
Include in every declaration or application for authorization the identity of the person responsible, the purpose, the data categories and their origin, the retention period, the recipients, the office where access is exercised, the planned security measures, and any subcontractor or cross-border transfer.NIST Privacy FrameworkID.IM-P4
Collect and process personal data lawfully and fairly, for specified and legitimate purposes, keeping it no longer than those purposes require, accurate, and transparent to the person concerned.NIST Privacy FrameworkGV.PO-P1
Choose a subcontractor who gives sufficient guarantees for the protection and security of the data, and ensure the subcontractor complies with this Law.NIST Privacy FrameworkID.DE-P2 NIST Privacy FrameworkID.DE-P5
Do not send unsolicited electronic direct-marketing messages using a person's personal data without their consent.NIST Privacy FrameworkCT.PO-P1
Do not interconnect files in a way that causes discrimination or a reduction of a person's rights, freedoms or guarantees.NIST Privacy FrameworkCT.PO-P1
Prevent unauthorized access to the installations and data used for processing, guard against the processing being used for money laundering or terrorist financing, and keep backup copies for security.NIST Privacy FrameworkPR.AC-P2 NIST Privacy FrameworkPR.PO-P3
Send ARTCI an annual report on compliance with these security measures.NIST Privacy FrameworkGV.MT-P4

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

ID.IM-P4Data actions of the systems/products/services are inventoried.
ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
ID.DE-P5Data processing ecosystem parties are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual, interoperability framework, or other obligations.
GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
GV.MT-P4Policies, processes, and procedures for communicating progress on managing privacy risks are established and in place.

3 more

CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
PR.PO-P3Backups of information are conducted, maintained, and tested.
PR.AC-P2Physical access to data and devices is managed.

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Public

What the log must hold

Event time, Actor identity, Access record

Logging duty

Article 41 requires the person responsible for the processing to be able to verify and establish afterwards who accessed the system, what data were introduced, modified, altered, copied, deleted or read, and when; that is an access and change trail. Article 12 has the internal correspondent for data protection keep a list of the processing performed, immediately accessible to anyone on request. Article 43 leaves the period for keeping the personal data to the Protection Body, which concerns the data and not the trail, and no period is stated for the trail or the list, so no retention value is given. Article 3 reaches any processing implemented on the national territory; that test turns on where the processing is run, and no hook value fits it, so the hook is left empty. The correspondent route is open to most processing under Article 6, and the prior declaration of Articles 5 and 9 is a filing with ARTCI, not a record the controller keeps.

Kind: Explicit
As of: 28 October 2026
Provision: Articles 12 and 41
Trigger: personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 2 states the Act's purpose as governing the protection of personal data, and article 3 subjects to it any collection, processing, transmission, storage or use of personal data by a natural person, the State, local authorities, or a public or private corporation, whether the processing is automated or not, excluding under article 4 only an individual's strictly personal or household processing and a network operator's temporary technical copies.

Article 5 makes ordinary processing subject to a prior declaration to ARTCI as the Autorité de Protection, and article 6 lets the declaration be replaced by an internal correspondent for most processing, though never before a cross-border transfer. Article 7 also requires the Authority's prior authorization before processing on a national identification number or a data set of public-interest research value.

Article 9 lists what a declaration or an application for authorization must contain, including the identity of the person responsible, the purpose, the categories of data and their origin, the retention period, the recipients, the office where access is exercised, the security measures planned, and any subcontractor or cross-border transfer, and article 11 gives the Authority one month, extendable by a further month, to decide, with silence read as a rejection open to appeal.

Article 12 lets the person responsible designate a correspondent for the protection of personal data to oversee compliance independently.

Article 14 makes processing legitimate where the person concerned gives express consent, subject to listed exceptions for a legal obligation, a public-interest task, a contract, or the person's vital interests, and articles 15 to 20 require processing to be lawful and fair, limited to specified and legitimate purposes, kept no longer than those purposes require, accurate, transparent, confidential, and carried out through a subcontractor who gives sufficient guarantees.

Article 22 prohibits direct marketing using a person's personal data without their consent. Article 27 authorizes the interconnection of files only for a legitimate purpose and bars it from causing discrimination or a reduction of rights.

Articles 39 to 41 require the processing to stay confidential, require precautions against distortion, damage or unauthorized access, and list the technical safeguards to install, including preventing unauthorized access to the installations and to the data, guarding against use for money laundering or terrorist financing, and keeping backup copies.

Article 42 requires an annual compliance report to the Authority, article 43 sets the retention period by reference to the Authority's rules for the type of processing, and article 44 requires the data to remain exploitable regardless of the support used. The Act states no separate data-breach notification duty running to the Authority or to the persons affected. No commencement notice for the Act has been located in the Official Gazette.

When LexLint raises it

When your app profile says your app sends automated outreach or processes personal data.

Back to the example · Lint your app

Page updated 19 September 2026.