NigerLoi n° 2022-59, protection des données à caractère personnel
Loi n° 2022-59 protection des données à caractère personnel, du 16 décembre 2022, telle que modifiée par la Loi n° 2023-31 du 4 juillet 2023 et les Ordonnances n° 2024-16 du 26 avril 2024 et n° 2024-29 du 24 juin 2024, arts. 2-5, 29-41, 64-67 et 77-86 (objet, champ d'application, formalités, principes directeurs et outils de conformité)
In force.
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Obligation class
- Consent, Governance, Security, Retention, DPIA, Licensing
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Obtain the data subject's express prior consent before processing their personal data, unless the processing is necessary for a legal obligation, a public-interest or official mission, performance of a contract, or safeguarding the data subject's own vital interests or fundamental rights.NIST Privacy FrameworkCT.PO-P1
- Collect personal data only for determined, explicit and legitimate purposes, and do not process it later in a way incompatible with those purposes or keep it longer than the purposes require.NIST Privacy FrameworkGV.PO-P1
- Keep personal data adequate, relevant and accurate, update it where necessary, and correct or erase it once you find it inaccurate or incomplete.NIST Privacy FrameworkCT.PO-P2
- Collect, record, process, store and transmit personal data lawfully, fairly and without fraud.NIST Privacy FrameworkGV.PO-P5
- Keep personal data confidential and implement technical and organizational measures against unauthorized access, loss or damage, including pseudonymization, encryption, and data protection by design and by default.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkGV.PO-P2
- Complete a prior declaration, authorisation request or advisory request with the HAPDP before implementing a processing operation, and obtain its prior authorisation for genetic, medical, biometric, interconnected, unique-identifier or sensitive-category processing.NIST Privacy FrameworkGV.PO-P5
- Keep a register of processing operations recording the collection, modification, consultation, disclosure, transfers, interconnection and deletion of personal data, and make it available to the HAPDP on request.NIST Privacy FrameworkID.IM-P4
- Carry out a privacy impact assessment before implementing a sensitive or high-risk processing operation the HAPDP requires one for.NIST Privacy FrameworkID.RA-P4
- Appoint a data-protection correspondent within your organization and notify the appointment to the HAPDP; a public-sector controller appoints a focal point instead.NIST Privacy FrameworkGV.PO-P3
- Where two or more controllers jointly determine the purposes and means of processing, define transparently each one's role toward data subjects, who may exercise their rights against each of them.NIST Privacy FrameworkGV.PO-P4
- Choose a processor that offers sufficient security and confidentiality guarantees, govern its processing under a written confidentiality contract, and hold it to the same obligations that bind you.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkID.DE-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
6 more
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P4Privacy roles and responsibilities are coordinated and aligned with third-party stakeholders (e.g., service providers, customers, partners).
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator, Data subject
What the log must hold
Access record
Logging duty
Article 64 requires every controller and processor to keep, before a processing operation starts, a register of operations that records the collection, modification, consultation, communication (transfers included), interconnection and deletion of personal data, and to make it available to the HAPDP on request, including at an on-site or document check. Article 80 has the data-protection correspondent keep a list of processing operations open to any data subject who asks. The filings with the HAPDP in articles 29 to 31 are filings and not a record the controller keeps, and the regular testing of security measures in article 82 reviews the measures and not the register. Article 4's prong for a controller outside Niger that uses processing means located in Niger is a means test and carries no hook value; its prong for processing that targets Nigerien citizens turns on nationality and is left out, so only the establishment prong and the offering of goods or services to persons in Niger are listed.
- Kind
- Explicit
- As of
- Provision
- Article 64
- Trigger
- personal_data_processing
What this law does
Article 3 binds every collection, processing, transmission, storage or use of personal data by a public or private legal person or a natural person, and article 4 extends the Act to a controller or processor established in Niger, one using processing means located on Niger's territory, and one targeting Nigerien citizens or offering goods or services to persons established in Niger.
Article 5 excludes only a purely personal or domestic use that is not disseminated to third parties, temporary technical copies made for network transmission, and journalistic, literary or artistic processing carried out under professional ethical rules.
Article 29 makes prior formality with the HAPDP, whether a simple declaration, an authorisation request or an advisory request, a precondition of processing, and article 31 lists the categories, including genetic, medical, biometric, interconnected, unique-identifier and sensitive-category processing, that need the HAPDP's prior authorisation rather than a bare declaration.
Article 37 makes the data subject's express prior consent the legitimacy test for processing, departing from it only where the controller is duly authorised and the processing is necessary for a legal obligation, a public-interest or official mission, performance of a contract, or safeguarding the data subject's own vital interests or fundamental rights.
Article 38 requires personal data to be collected for determined, explicit and legitimate purposes and kept no longer than those purposes require, article 39 requires it to be adequate, relevant, accurate and kept up to date, and article 40 requires collection, recording, processing, storage and transmission to proceed lawfully, fairly and without fraud.
Article 41 and article 82 require the controller and any processor it engages to keep personal data confidential and to implement technical and organisational measures, including pseudonymisation, encryption and data protection by design and by default, against unauthorised access, loss or damage.
Article 64 requires a register of processing operations made available to the HAPDP on request, and article 67 lets the HAPDP demand a privacy impact assessment before authorising a sensitive or high-risk processing operation.
Article 79 requires a private-sector controller to designate a data-protection correspondent and notify the appointment to the HAPDP, while a public-sector controller designates a focal point instead, and article 86 requires a processor to offer sufficient security guarantees, to operate under a written confidentiality contract, and to answer to the same obligations as the controller.
Article 113, the closing article, orders publication in the Journal Officiel and execution as a law of the State, but names no day of the Law's own entry into force, and no commencement notice has been located in the Journal Officiel.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .