LexLint.ioBeta

Know the law your code answers to.

Law / Senegal

Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel (Personal Data Protection Act)

Loi n° 2008-12 du 25 janvier 2008 sur la Protection des Données à Caractère Personnel arts. 1-4, 17-24, 33-39, 45-46, 52-57, 70-74 (principes généraux, formalités préalables et obligations du responsable)

In force.

A comprehensive regime rule binding public and private bodies.

How the hook was established
express
What makes it apply
Operator establishment
Obligation class
Consent, Governance, Security, Retention
Audit expectation
none

What it requires

  • Have a lawful basis, ordinarily the person's consent, before collecting, processing, transmitting, storing, or using their personal data.NIST Privacy FrameworkCT.PO-P1
  • Take precautions appropriate to the nature of the data, including restricting access to authorized staff and keeping security copies.NIST Privacy FrameworkPR.AC-P4NIST Privacy FrameworkPR.PO-P3
  • Declare your processing to the CDP before you start it, using its published form, and do not implement the processing until you receive the CDP's certificate of receipt.NIST Privacy FrameworkGV.PO-P5
  • Choose a sub-processor offering sufficient guarantees, bind them by a written contract limited to your instructions, and keep processing confidential and restricted to authorized staff.NIST Privacy FrameworkID.DE-P3
  • Get the CDP's authorization before combining personal data files across purposes or processing a national identification number or other general-purpose identifier.NIST Privacy FrameworkGV.PO-P5
  • Do not keep personal data longer than its purpose requires, unless you keep it only for historical, statistical, or scientific treatment.NIST Privacy FrameworkCT.PO-P2

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
  • GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
  • CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
  • PR.PO-P3Backups of information are conducted, maintained, and tested.
  • PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
NIST CSF 2.0
  • GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
  • PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
FINOS AIGF
7 more

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

What the log must hold

Event time, Actor identity, Access record

Logging duty

Article 71 requires the controller to take measures so that, after the fact, it can verify the identity of the persons who accessed the information system and which data were read or entered, at what time and by which person (point 3), and the identity of the third parties to whom data may be transmitted (point 2). The Law names no log, but that verification cannot be made without a record of each access, so the duty is read from the clause. The contents are the access, the person and the time. The formalities in Articles 17 to 24 (declaration, authorization and their particulars) are filings with the Commission and not records the controller keeps, and the storage limit in Articles 35 and 72 limits the personal data and not a record. Written undertakings by staff (Article 70) and a written processor contract (Article 39) are not records of processing. The Commission's powers to demand documents and data are in Articles 25 to 28, which this row does not cite, so audit and access are left empty. Article 2(3) applies the Law to processing carried out by a controller on Senegalese territory; the prong in Article 2(4) that turns on processing means located in Senegal has no hook value and is left out.

Kind
Implicit
As of
Provision
Article 71, point 3 (the controller must be able to verify after the fact who accessed the system and which data were read or entered, when and by whom), with point 2 (the identity of recipients)
Trigger
personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 2 subjects to the Act any collection, processing, transmission, storage or use of personal data by a natural person, the State, local authorities, or a public or private legal person, and article 3 exempts only a person's exclusive personal or domestic processing and transient technical transmission copies.

Article 33 makes a data subject's consent the general basis for lawful processing, with derogations for a legal obligation, a public interest or official mission, performance of a contract, or safeguarding the data subject's vital interests. Articles 34 through 37 require collection and processing to be lawful, fair and non fraudulent, limited to determined and legitimate purposes, kept accurate and updated, and carried out under a duty of transparency toward the data subject.

Article 38 requires processing to be confidential and secured under article 71, and article 39 requires a controller using a sub processor to choose one offering sufficient guarantees and to bind it by a written contract limited to the controller's own instructions.

Outside the exemptions article 17 lists, article 18 requires a controller to declare its processing to the CDP and wait for the CDP's certificate of receipt before implementing it, and articles 22 through 24 set what a declaration or authorization request must state and the two month period the CDP has to decide it.

Article 20 requires the CDP's prior authorization before processing genetic data or health related research data, data on criminal offences or convictions, an interconnection of files, a national identification number or other general purpose identifier, biometric data, or a public interest historical, statistical or scientific treatment, and articles 53 through 57 set the interconnection authorization procedure.

Article 45 admits processing for journalism, research or artistic or literary expression carried out under the professional rules of those activities, and article 46 leaves the press laws and the Penal Code's own right of reply and privacy protections in place.

Article 71 requires precautions appropriate to the nature of the data, article 72 bars keeping data longer than its purpose needs except for historical, statistical or scientific treatment, article 73 restricts an electronic certification provider to collecting data directly from the person concerned and using it only to issue and keep the certificate, and article 74 requires a controller to keep data usable whatever technical medium stores it. Loi n° 2008-12 was promulgated on .

It was published in Journal officiel n° 6406 of . The law's final articles state no day of its own for its entry into force.

Under article 2 of Loi n° 70-14 du 6 février 1970, a promulgated law that does not postpone its entry into force becomes executory on the third day after the Journal officiel issue carrying it is deposited at the General Secretariat in the Cap-Vert region and the communes of Diourbel, Kaolack, Saint-Louis and Thiès, and on the fifth day in the rest of the territory. Article 17 of Loi n° 2021-21 du 2 mars 2021 abrogates Loi n° 70-14, as modified by Loi n° 71-07 du 21 janvier 1971. No official record of the day on which the law became executory has been located.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .