MaliLoi n° 2013-015, protection des données à caractère personnel
Loi n° 2013-015 du 21 mai 2013 portant protection des données à caractère personnel en République du Mali telle que modifiée, arts. 1, 4-8, 57 (objet, champ d'application, principes et déclaration)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Governance, Security, Reporting
- Audit expectation
- none
What it requires
- Collect and process personal data fairly, lawfully, and without fraud, only for determined, explicit, and legitimate purposes, never using it for another purpose, and keep it adequate, proportionate, and relevant to those purposes, accurate and updated where necessary, and identifiable for no longer than those purposes require.NIST Privacy FrameworkGV.PO-P1
- Take every precaution useful to preserve the security of personal data, including preventing unauthorized access, deformation, or damage, and use a processor only where it offers sufficient security and confidentiality guarantees, which does not relieve you of your own duty to see those guarantees are met.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkID.DE-P2
- Declare to the Autorité de Protection des Données à Caractère Personnel, before carrying it out, any processing operation you intend to carry out for a given purpose.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 1, 4 to 8 and 57 set the purpose, the scope, the principles, the security obligation and the declaration of operations to the Autorité. Article 8 makes the controller take every useful precaution to preserve the security of the data and lets investigating authorities ask it for personal data, and Article 57 has controllers declare the operations they intend to carry out to the Autorité; none of them names a log, register or record the controller keeps, and a declaration filed with the authority is a filing, not a record the controller holds. Article 7's rule that data be kept no longer than the purposes need limits the personal data, not a record. Article 4 applies the law to processing carried out wholly or partly on national territory, and Article 5(2) reaches a controller established or not on that territory except for means used only for transit; the scope turns on where the processing or the means are located, which has no hook value, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 1 has the Malian State assure every natural or legal, public or private person the protection of their personal data, without distinction of race, origin, colour, sex, age, language, religion, wealth, birth, opinion, nationality, or another such ground, and article 4 applies the Act to every processing of personal data carried out wholly or partly on national territory.
Article 5 subjects to the Act any processing by the State, territorial authorities, incorporated public bodies, and private natural or legal persons, any processing a controller carries out whether or not established on Malian territory, excluding only means used solely for transit, and processing concerning public security, national defence, or the investigation and prosecution of criminal offences, subject to this Act's own derogations or to specific provisions of other texts.
Article 6 excludes only two categories from the Act's scope: processing a natural person carries out in the exclusive context of personal or domestic activities, provided the data are not destined for systematic communication to third parties or dissemination, and temporary copies made for the technical activities of transmitting and providing access to a digital network.
Article 7 requires personal data to be collected and processed fairly, lawfully, and without fraud, for determined, explicit, and legitimate purposes, never used for other purposes, kept adequate, proportionate, and relevant to those purposes, accurate and updated where necessary, and kept in a form permitting identification of the persons concerned for no longer than those purposes require.
Article 8 requires the controller to take every precaution useful to preserve data security, including preventing deformation, damage, or unauthorized third-party access, requires a processor to offer sufficient guarantees of security and confidentiality, and states that this requirement does not relieve the controller of its own duty to see that those measures are respected.
Article 57 requires a controller to declare to the Autorité de Protection des Données à Caractère Personnel the processing operations it intends to carry out for a given purpose, and lets the Autorité impose an administrative sanction where that declaration was omitted in bad faith.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .