TogoLoi n° 2019-014, protection des données à caractère personnel
Loi n° 2019-014 du 29 octobre 2019 relative à la protection des données à caractère personnel arts. 1-20, 32-34, 51-54, 75-78 and 94-97 (comprehensive regime, formalities and obligations)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2020. Publisher's page: https://numerique.gouv.tg/wp-content/uploads/2020/01/Loi-n-2019-014-du-29-octobre-2019-relative-a-la-protection-des-donnees-a-caractere-pers…In force.
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Governance, Security, Retention
- Audit expectation
- none
What it requires
- Have a lawful basis for processing personal data, generally the data subject's consent, or rely on a legal obligation, a public interest task, contract performance, or safeguarding the data subject's interest or fundamental rights and freedoms.NIST Privacy FrameworkCT.PO-P1
- Declare personal data processing to the Instance de Protection des Données à Caractère Personnel before implementing it, unless the processing is exempt from formalities, requires prior authorization, or requires a reasoned government opinion.NIST Privacy FrameworkGV.PO-P5
- Obtain the Instance's prior authorization before interconnecting files that serve different purposes, processing a national identification number or other general purpose identifier, or processing personal data for a historical, statistical or scientific public interest purpose.NIST Privacy FrameworkGV.PO-P5
- Collect and process personal data lawfully and fairly, only for determined and legitimate purposes, keep it accurate and up to date, and do not retain it beyond the period necessary for those purposes.NIST Privacy FrameworkGV.PO-P1
- Choose a processor that offers sufficient guarantees, govern the engagement with a written contract confining the processor to your instructions, and keep processing confidential under the authority of persons who have signed a written confidentiality undertaking.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkPR.PO-P9
- Take appropriate technical and organizational measures to prevent unauthorized access to, alteration of, or loss of personal data, and keep the data usable regardless of changes in the storage technology used.NIST Privacy FrameworkPR.DS-P5
- Where you appoint a data protection correspondent to qualify for the formality exemption, notify the appointment to the Instance and have the correspondent advise on compliance, cooperate with the Instance, and keep an accessible list of the processing you carry out.NIST Privacy FrameworkGV.PO-P3NIST Privacy FrameworkID.IM-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- NIST CSF 2.0
- GV.RR-04Cybersecurity is included in human resources practices
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 52, point 3 makes the controller guarantee that the identity of the persons who had access to the information system, which data they read or entered and when can be verified after the event, which is an access log; point 2 does the same for the identity of third parties to whom data may be sent. Article 76, point 5 has the data protection correspondent keep an immediately accessible list of the processing carried out, and names no one entitled to it, so no accessor is coded. The row's articles set no period for these records (Article 16 limits how long the personal data itself is kept, which is not a period for a log or register). Article 76, point 2 has a correspondent monitor compliance, including related audits, but appointing one is optional (Article 5, point 3 offers it as a way out of the prior formalities) and no schedule is set, so no audit is coded. The Instance's power to demand documents sits in Article 68, which this row does not cite. Article 2, point 3 reaches processing by a controller on Togolese territory or wherever Togolese law applies; point 4 turns on where the processing means are located and carries no hook value, so it is left out.
- Kind
- Explicit
- As of
- Provision
- Article 52, point 3 (after-the-fact verification of who accessed which data, and when); Article 76, point 5 (list of processing kept by the data protection correspondent)
- Trigger
- personal_data_processing
What this law does
Article 1 states the law's object as regulating the collection, processing, transmission, storage, use and protection of personal data, and article 2 extends it to any such processing by a natural person, the State, a local authority, or a public or private legal person, whether automated or not.
Article 6 requires most processing to be declared to the Instance de Protection des Données à Caractère Personnel beforehand, unless article 5 exempts it from formalities, article 8 requires prior authorization, or article 9 requires a reasoned government opinion, and articles 10 to 13 fix the common content, timing and channel for these requests.
Article 14 makes the data subject's consent the general lawful basis for processing, subject to derogations for a legal obligation, a public interest task, contract performance, or safeguarding the interest or fundamental rights and freedoms of the data subject, and articles 15 to 19 add the lawfulness, purpose limitation, accuracy, transparency, confidentiality and security principles.
Article 20 requires a processor to offer sufficient guarantees and to be bound by a written contract confining it to the controller's instructions. Articles 32 to 34 require the Instance's authorization before interconnecting files that serve different purposes, on a request stating the data, purpose and duration involved.
Article 51 keeps processing confidential to persons who have signed a written confidentiality undertaking, article 52 requires appropriate technical and organizational security measures, article 53 caps retention at the period necessary for the processing's purpose, and article 54 requires data to remain usable regardless of changes in storage technology.
Where a controller appoints a data protection correspondent to qualify for the article 5 formality exemption, articles 75 to 78 require the appointment to be notified to the Instance and task the correspondent with advising on compliance, cooperating with the Instance, and keeping an accessible list of the processing carried out.
Article 97, the closing article, provides that the law is executed as a law of the State but names no day of its own entry into force, and no commencement notice has been located in the Journal officiel.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .