MauritaniaLoi n° 2017-020, protection des données à caractère personnel
Loi n° 2017-020 du 22 juillet 2017 relative à la protection des données à caractère personnel arts. 1, 3-11, 17, 26-49 (principes généraux, formalités préalables et obligations du responsable)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Governance, Consent, Retention
- Audit expectation
- none
What it requires
- Do not process a person's personal data once they have validly objected, including where the processing serves commercial prospecting.NIST Privacy FrameworkCT.PO-P3
- Complete the Personal Data Protection Authority's prior formalities before processing personal data; failing to do so, even negligently, is a criminal offence.NIST Privacy FrameworkGV.PO-P5
- Declare your processing to the Authority before you start it, unless article 32 exempts it.NIST Privacy FrameworkGV.PO-P5
- Choose a sub-processor offering sufficient guarantees, bind them by a written act limited to your instructions, and extend the confidentiality duty to anyone who takes part in the sub-processing.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkID.DE-P2
- Get the Authority's authorization before interconnecting files across different public bodies or across private bodies with different purposes, or before processing a national identification number or other general-purpose identifier.NIST Privacy FrameworkGV.PO-P5
- Do not keep personal data longer than its purpose requires, unless you keep it only for historical, statistical, or scientific treatment, and keep it usable, converting it for durable storage where needed.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 47, point 2 requires the controller to take every measure so that the identity of the persons who had access to the information system, which data were read or entered, and when and by whom, can be verified and established afterwards; that is an access and entry trail. No period is stated for keeping the trail, so no retention value is given, and no audit or recipient of the trail is named in the sections the row cites. Article 48 limits how long the personal data may be kept and article 49 requires backup copies of the data, which concern the data and not a log. Articles 33, 37 and 43 are filings with the Authority (declaration, authorization and the particulars to supply), not records the controller keeps, and the Authority's own public register of processing is its record (article 73, point 4). Article 3 reaches processing carried out on Mauritanian territory or where Mauritanian law applies and processing by a controller using means located in the country; those prongs turn on where the processing is run, have no hook value, and the hook is left empty.
- Kind
- Explicit
- As of
- Provision
- Article 47, point 2 (after-the-fact trail of access and entry)
- Trigger
- personal_data_processing
What this law does
Article premier sets the law's object as establishing a normative and institutional framework for processing personal data, so that any processing of personal data, in whatever form, respects citizens' fundamental freedoms and rights.
Article 3 applies the law to processing by a natural person, the State, local authorities, or a public or private legal person, to any structured file, and to a controller operating in Mauritania or using processing means located there, and article 4 exempts only a person's exclusive personal or domestic processing and transient technical transmission copies.
Article 5 makes a data subject's consent the general basis for lawful processing, with derogations similar to the omnibus consent article, and articles 6 through 9 require collection to be lawful, fair and non fraudulent, limited to determined and legitimate purposes, kept accurate and updated, and carried out under a duty of transparency toward the data subject.
Article 10 requires processing to be confidential and protected under article 47, and article 11 requires a written act binding a sub-processor to the controller's own instructions, extending confidentiality to anyone taking part in that sub-processing. Article 17 admits processing for journalism, research or artistic or literary expression carried out under the professional, legislative or regulatory rules of those activities.
Articles 26 through 31 require the Authority's authorization before interconnecting files held by different public bodies or by private bodies with different purposes, on a request stating the data, purpose, and safeguards involved.
Outside the exemptions article 32 lists, article 33 requires a controller to declare its processing to the Authority, and articles 37 through 45 require the Authority's prior authorization for the categories article 37 lists, including an interconnection of files, a national identification number or other general purpose identifier, or a public interest historical, statistical or scientific treatment.
Article 46 requires processing to stay strictly confidential and carried out only by persons the controller has vetted for technical, legal and personal integrity guarantees, article 47 requires precautions appropriate to the nature of the data, article 48 bars keeping data longer than its purpose needs except for historical, statistical or scientific treatment, and article 49 requires a controller to keep data usable and, where needed, converted for durable storage.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .