Niger

Article 83 requires the controller to notify the HAPDP of a personal data breach without delay after becoming aware of it, and to justify to the HAPDP any notification made outside that timeframe. The controller must also notify the affected person as soon as possible when the breach is likely to create a high risk to their rights and freedoms, and is excused from notifying the person only where it is reasonable to believe the breach creates no such risk.

Article 86 requires a data processor to notify the controller of a personal data breach as soon as possible and, at the latest, within 72 hours of becoming aware of it.

Article 3 binds every collection, processing, transmission, storage or use of personal data by a public or private legal person or a natural person, and article 4 extends the Act to a controller or processor established in Niger, one using processing means located on Niger's territory, and one targeting Nigerien citizens or offering goods or services to persons established in Niger.

Article 5 excludes only a purely personal or domestic use that is not disseminated to third parties, temporary technical copies made for network transmission, and journalistic, literary or artistic processing carried out under professional ethical rules.

Article 29 makes prior formality with the HAPDP, whether a simple declaration, an authorisation request or an advisory request, a precondition of processing, and article 31 lists the categories, including genetic, medical, biometric, interconnected, unique-identifier and sensitive-category processing, that need the HAPDP's prior authorisation rather than a bare declaration.

Article 37 makes the data subject's express prior consent the legitimacy test for processing, departing from it only where the controller is duly authorised and the processing is necessary for a legal obligation, a public-interest or official mission, performance of a contract, or safeguarding the data subject's own vital interests or fundamental rights.

Article 38 requires personal data to be collected for determined, explicit and legitimate purposes and kept no longer than those purposes require, article 39 requires it to be adequate, relevant, accurate and kept up to date, and article 40 requires collection, recording, processing, storage and transmission to proceed lawfully, fairly and without fraud.

Article 41 and article 82 require the controller and any processor it engages to keep personal data confidential and to implement technical and organisational measures, including pseudonymisation, encryption and data protection by design and by default, against unauthorised access, loss or damage.

Article 64 requires a register of processing operations made available to the HAPDP on request, and article 67 lets the HAPDP demand a privacy impact assessment before authorising a sensitive or high-risk processing operation.

Article 79 requires a private-sector controller to designate a data-protection correspondent and notify the appointment to the HAPDP, while a public-sector controller designates a focal point instead, and article 86 requires a processor to offer sufficient security guarantees, to operate under a written confidentiality contract, and to answer to the same obligations as the controller.

Article 62 bars transferring personal data to another State unless that State ensures a sufficient level of protection for privacy and fundamental rights and freedoms, assessed by its data-protection laws, regulations and the existence of a protection authority, or by the international conventions it has joined or safeguards the HAPDP has approved, and requires the controller to first implement technical and organisational security measures, including encryption, availability, confidentiality, integrity and system resilience, and to obtain the HAPDP's authorisation before the transfer.

The HAPDP may withdraw that authorisation at any time if exceptional circumstances arise in the destination country.

Article 63 permits a transfer to a State that does not ensure adequate protection only where the data subject gave specific, free, informed and unambiguous consent after being told the risks of the missing safeguards, the transfer safeguards a vital or public interest, a law or regulation authorises it after the HAPDP's opinion, a bilateral or multilateral agreement Niger has joined applies, a HAPDP-approved contract or binding corporate rules guarantee adequate protection, or the transfer serves a legal claim or a contract in the data subject's interest.

Article 68 requires the controller to give the data subject information about the processing no later than the time of collection.

Article 69 gives a data subject a direct right of access to their data, by on-site consultation or by copy, and lets the HAPDP exercise that access on the person's behalf, ordering rectification, erasure or locking of non-compliant data, when direct access is impossible; article 70 substitutes an indirect right of access through a HAPDP-designated investigator for processing touching state security, defence or public safety.

Article 71 gives a person, or a deceased person's heirs, the right to have inaccurate, incomplete, ambiguous or outdated data rectified, completed, updated, locked or erased within one month of the request.

Article 51 bars any direct-marketing solicitation using a person's data without their prior consent, and article 72 gives a person the right to object to processing for legitimate reasons particular to their situation and an unconditional right to object, free of charge, to processing for direct marketing, with prior notice before their data is first used or disclosed for that purpose.

Article 73 gives a person the right to erasure of unlawfully processed, withdrawn-consent or purpose-lapsed data, including data concerning a minor, subject to listed retention exceptions, and article 74 gives a right to digital erasure requiring the controller to tell any third party who processed data made public online to delete it as well.

Article 75 gives a right to a temporary freeze on the use of some of a person's data, and article 76 gives a right to receive a copy of one's data in a structured, commonly used, machine-readable format and to have it transmitted directly to another controller.

Article 52 bars a judicial, administrative or private decision assessing a person's behaviour or personality from resting solely on automated processing, and gives every person the right to know and contest the criteria and reasoning an automated or artificial-intelligence-based decision used against them.

Article 87 lets the HAPDP's President assign sworn control agents to verify compliance with the Act and its own deliberations, and article 88 gives those agents access to the premises, installations and establishments used for a processing operation, excluding the parts serving as a private home.

Article 92 lets the HAPDP issue a warning or a formal notice fixing a deadline to end a violation after a contradictory procedure, and where the controller does not comply, lets it withdraw the processing authorisation, provisionally or definitively, and impose a pecuniary sanction. Article 93 lets it order the interruption of a persistent unlawful processing operation, the locking of the data concerned, or a temporary or permanent ban on the processing.

Article 94 caps a pecuniary sanction proportional to the seriousness of the violation and the advantage gained at 100,000,000 CFA francs, rising, for a repeat violation confirmed within two years of the earlier sanction becoming final, to 200,000,000 francs, or, where the offender is a company, to 5 percent of its previous financial year's turnover excluding tax, within a ceiling of 500,000,000 francs.

Chapter XIV criminalises specific violations, from illicit processing of sensitive data to unauthorised disclosure, fraudulent collection, direct marketing without consent, and obstructing a data subject's rights or the HAPDP itself, each punished with imprisonment and a fine running as high as five years and 50,000,000 francs for the most serious offences.

Article 108 lets a person who considers themselves harmed in their privacy, or whose complaint to the controller went unanswered, complain to the HAPDP. Article 109 lets a person appeal a HAPDP sanction or decision to the Conseil d'État. Article 110 gives a data subject a judicial remedy independent of a HAPDP complaint, including urgent injunctive relief for a serious and immediate violation of their rights.

Article 42 prohibits processing data revealing racial, ethnic or regional origin, filiation, political opinions, religious or philosophical beliefs, trade-union membership, sex life, health, morals, genetic or biometric data, social measures, or criminal or administrative sanctions, except where the data subject made it manifestly public themselves, gave written consent, the processing is necessary to establish, exercise or defend a legal claim, or the processing serves the legitimate, members-only activities of a non-profit association.

Article 43 permits collecting and processing health data only for preventive medicine, medical diagnosis, care or health-service administration by a health professional, public-health protection or humanitarian action, safeguarding vital interests where consent cannot be obtained, administering social-protection benefits, a legal claim, or research approved by the National Health Research Ethics Committee, and restricts that processing to physicians or persons bound by professional secrecy.

Article 44 limits the exchange of health data between health professionals to what coordinating or continuing care requires, article 45 bars an insurer or an employer from receiving health data unless a law or regulation specifically authorises it, article 46 conditions health data processing for medical research on the data subject's consent and prior transparent information, and article 47 requires health data to be anonymised before sharing or publication and hosted in Niger where it permits identification.

Article 48 restricts processing genetic data to establishing a genetic link in litigation, identifying a person in a criminal investigation, prevention, diagnosis or treatment of the data subject or a biological relative, or scientific research, and conditions it on the data subject's or their legal representative's consent.

Article 49 requires the HAPDP's prior authorisation before any processing of biometric data, on top of the particular, justified necessity and safeguards the Act demands of it, and article 50 restricts processing data on offences, convictions and security measures to courts, public authorities acting within their powers, and legal auxiliaries acting strictly within their assigned duties.

The Act names no separate rule conditioning a minor's data on a parent's or guardian's consent; a minor's status functions only as a ground for erasure under article 73.

Article 3 punishes with one to three years' imprisonment and a fine of 500,000 to 1,000,000 CFA francs anyone who accesses, intentionally and without right, all or part of a computer system, rising to three to five years' imprisonment and a fine of 2,000,000 to 5,000,000 CFA francs where the access results in the suppression, modification or alteration of the data it holds, or in a malfunction of the system.

Article 4 punishes the same two tiers for remaining, intentionally and without right, present in all or part of a computer system after the initial access. Neither article conditions the offence on infringing a technical security measure, but both require the access or continued presence to be 'without right' (sans droit), which a person reading a page that is public and unauthenticated is not; no reported Nigerien decision has applied either article to ordinary open-web crawling.

Article 7 excludes from copyright protection official legislative, administrative or judicial texts and their official translations, the news of the day, ideas, procedures, systems, operating methods, concepts, principles, discoveries or simple data even when stated, described, explained, illustrated or embodied in a work, and simple facts and data.

Article 2.3 defines a database as a compilation of data or facts, which article 5 protects only as a collection (recueil), like an encyclopaedia, to the extent its selection or arrangement is an original creation, and article 10 withholds the free-reproduction privilege from the whole or a substantial part of a database, so a database is protected, if at all, as an ordinary compilation rather than under a separate sui generis right.

Article 11 permits quoting a lawfully published work in another work, without the author's authorisation and without payment, on condition that the source and the author's name are indicated and the quotation conforms to fair practice and does not exceed the extent justified by its purpose; unlike a dedicated press-review clause, this quotation exception carries no separate allowance for reproducing a current political, social or economic news article in full.

Article 107 repeals Ordonnance n° 93-027 du 30 mars 1993, which stated an identical objects-not-protected exclusion and an identical quotation exception in its own articles 6 and 10.