Togo

Article 1 states the law's object as regulating the collection, processing, transmission, storage, use and protection of personal data, and article 2 extends it to any such processing by a natural person, the State, a local authority, or a public or private legal person, whether automated or not.

Article 6 requires most processing to be declared to the Instance de Protection des Données à Caractère Personnel beforehand, unless article 5 exempts it from formalities, article 8 requires prior authorization, or article 9 requires a reasoned government opinion, and articles 10 to 13 fix the common content, timing and channel for these requests.

Article 14 makes the data subject's consent the general lawful basis for processing, subject to derogations for a legal obligation, a public interest task, contract performance, or safeguarding the interest or fundamental rights and freedoms of the data subject, and articles 15 to 19 add the lawfulness, purpose limitation, accuracy, transparency, confidentiality and security principles.

Article 20 requires a processor to offer sufficient guarantees and to be bound by a written contract confining it to the controller's instructions. Articles 32 to 34 require the Instance's authorization before interconnecting files that serve different purposes, on a request stating the data, purpose and duration involved.

Article 51 keeps processing confidential to persons who have signed a written confidentiality undertaking, article 52 requires appropriate technical and organizational security measures, article 53 caps retention at the period necessary for the processing's purpose, and article 54 requires data to remain usable regardless of changes in storage technology.

Where a controller appoints a data protection correspondent to qualify for the article 5 formality exemption, articles 75 to 78 require the appointment to be notified to the Instance and task the correspondent with advising on compliance, cooperating with the Instance, and keeping an accessible list of the processing carried out.

Article 97, the closing article, provides that the law is executed as a law of the State but names no day of its own entry into force, and no commencement notice has been located in the Journal officiel.

Article 28 permits a transfer of personal data to a third country only if that country ensures a sufficient level of protection for privacy, freedoms and fundamental rights, and requires the controller to inform the Instance beforehand for its reasoned opinion.

Article 29 admits a one off, non massive transfer to a country that does not meet that standard where the data subject has expressly consented, or the transfer is necessary to safeguard the person's life, the public interest, a right in court, or a contract with the person.

Article 30 lets the Instance authorize a transfer or set of transfers to a country lacking adequate protection on a reasoned request, where the controller offers sufficient guarantees for privacy, fundamental rights and freedoms and for the exercise of the corresponding rights.

Article 31 requires the Instance, before any processing of personal data received from abroad, to verify that the controller assures a sufficient level of protection, judged by the security measures applied, the processing's purpose and duration, and the nature, origin and destination of the data.

Article 97, the closing article, provides that the law is executed as a law of the State but names no day of its own entry into force, and no commencement notice has been located in the Journal officiel.

Article 27's second sentence bars any decision producing legal effects concerning a person from resting solely on automated processing of their personal data designed to define their profile or evaluate aspects of their personality. Its third sentence excludes a decision taken in concluding or performing a contract on which the person could present observations, and a decision granting the person's own request.

A first sentence in the same article separately bars a court decision on a person's conduct from resting on that kind of processing; that sentence binds courts only and is not part of this right. Article 97, the closing article, provides that the law is executed as a law of the State but names no day of its own entry into force, and no commencement notice has been located in the Journal officiel.

Article 35 requires a controller collecting data directly from the data subject to disclose, at the latest when collecting it, its identity, the purposes of the processing, the categories of data, the recipients, whether an answer is mandatory, the possibility of objecting to inclusion in the file, the rights of access and rectification, the retention period, and any transfer abroad envisaged.

Article 39 gives a data subject the right to demand confirmation of processing, communication of their data in an accessible form together with its origin, and information on the purposes, categories, recipients and any transfer abroad, and article 40 entitles them to a copy at no more than reproduction cost.

Article 45 gives a data subject the right to object, on legitimate grounds, to processing of their data, and the right to be told before their data is first disclosed to or used by a third party for prospecting and to object to that disclosure or use free of charge, subject to the exception for processing required by a legal obligation.

Article 46 lets a data subject demand correction, completion, updating, locking or deletion of data that is inaccurate, incomplete, ambiguous, outdated or unlawfully held, within one month and at no cost, and requires the controller to notify any third party the data was disclosed to.

Article 47 requires a controller who has made a data subject's data public to take reasonable measures, including technical ones, to tell third parties processing that data to erase links to it or any copy, on the data subject's request. Article 26 bars unsolicited direct marketing using a person's data without their prior consent to receive it.

Article 50 lets the heirs of a deceased data subject require the controller to record the death and make the necessary updates, and requires the controller to justify doing so free of charge. Article 97, the closing article, provides that the law is executed as a law of the State but names no day of its own entry into force, and no commencement notice has been located in the Journal officiel.

Article 55 creates the Instance de Protection des Données à Caractère Personnel (IPDCP) as an independent administrative authority tasked with ensuring that processing complies with the law, and article 56 gives it the missions of receiving formalities, receiving and answering complaints, alerting the public prosecutor to offenses it learns of, verifying processing, sanctioning controllers under article 71, answering opinion requests, approving conduct codes, keeping a public register, advising controllers, authorizing cross border transfers, proposing legislative improvements, cooperating internationally, publishing authorizations and opinions, and reporting annually to the President, the Prime Minister and the presidents of the two legislative chambers.

Article 70 lets the Instance issue a warning or a formal notice fixing a deadline to end a breach, and article 71 lets it, after a hearing, provisionally or ultimately withdraw an authorization or impose a fine of up to XOF 100,000,000 where the controller does not comply.

Articles 72 and 73 let the Instance take emergency and conservatory measures, including interrupting a processing operation, locking data, ordering compliance under a daily penalty of up to XOF 5,000,000, or sealing and removing equipment used in an unauthorized processing operation, and article 74 lets the Instance's decisions be appealed before the administrative chamber of the Supreme Court.

Article 93 punishes obstructing the Instance's action, whether by opposing its members' or agents' missions, refusing to communicate the information or documents they request, or supplying information that does not match the records, with six months to two years' imprisonment and a fine of XOF 1,000,000 to XOF 10,000,000.

Article 97, the closing article, provides that the law is executed as a law of the State but names no day of its own entry into force, and no commencement notice has been located in the Journal officiel.

Article 8 requires the Instance's prior authorization before processing genetic data, health research data, biometric data, or data on criminal offenses, convictions or security measures. Article 21 prohibits collecting or processing data revealing racial or ethnic origin, filiation, political opinions, religious or philosophical convictions, trade union membership, sex life, genetic data, or health data.

Article 22 lifts that prohibition where the data was manifestly made public by the data subject, where the data subject gave written consent, where the processing safeguards a vital interest the data subject cannot consent to protect, or on a short further list including a judicial, public interest, historical, statistical or scientific purpose.

Article 23 restricts processing of data on offenses, convictions or security measures to courts, public authorities, bodies managing a public service, and legal auxiliaries acting within their legal duties.

Article 24 makes health data processing lawful only on a listed ground such as the data subject's consent, requires it to be carried out under the supervision of a health professional bound by professional secrecy, and requires the data to be collected directly from the data subject except where collection elsewhere is necessary or the data subject cannot provide it.

Article 97, the closing article, provides that the law is executed as a law of the State but names no day of its own entry into force, and no commencement notice has been located in the Journal officiel.

Article 8 punishes any person who, without right, accesses or attempts to access, or remains or attempts to remain, in all or part of a computer system, with six months to two years' imprisonment and a fine of XOF 5,000,000 to XOF 20,000,000, or either penalty alone. The penalty doubles where the access results in a serious disruption or interruption of the system.

It rises to five years' imprisonment and a fine of XOF 15,000,000 to XOF 60,000,000 where the offense is committed to the detriment of the Togolese State.

The provision's trigger is access without right rather than the circumvention of a security measure, so unlike a statute that requires infringing an access control, its plain text does not on its own resolve whether reading a public, unauthenticated page falls inside or outside the offense, and no reported Togolese decision has addressed the question.

Article 9 of the same law separately punishes destroying, hindering, falsifying, disrupting or interrupting the functioning of a computer system, and article 10 separately punishes introducing, deleting, altering, destroying, extracting or intercepting computerised data, each with three to five years' imprisonment and a fine of XOF 25,000,000 to XOF 100,000,000; both are aimed at interference with or extraction of data from a system rather than passive reading of a page it makes public.

Article 48, the closing article, leaves the manner of the law's application to implementing decrees and names no day of the law's own entry into force, and no commencement notice has been located in the Journal officiel.

Arrêté N°2022-040/PMRT of 29 June 2022 adopts the Cybersecurity Rules. Section 3 of the Rules provides that, under the OSE decree, an operator of essential services must comply with the Rules under pain of sanctions. Section 3 of the Rules states that the Rules are set by ANCy under Article 11 of the OSE decree. Section 1 of the Rules defines the OSE decree as decree n°2019-095/PR of 8 July 2019 on operators of essential services, essential infrastructures and the obligations attached to them.

Rule G2.1.2 requires the operator to establish and send ANCy a set of supporting cybersecurity policies. Rule G2.1.3 requires cybersecurity policies to be maintained, reviewed and updated annually and when significant changes occur. Rule G1.1.6 requires the operator to send the contact details of its information-systems security manager or cybersecurity point of contact to its sectoral supervisory authority, to ANCy and to its delegate within six months of the notification of its designation.

Rule G5.2.4 requires the operator to send ANCy or its delegate the list of its essential personnel within three months of the notification of its designation. Rule D1.3.1 requires the operator to put in place detection devices able to identify events characteristic of a security incident. Rule D1.3.1 requires the detection devices of an operator of essential services to archive the metadata of identified events for at least six months.

Rule D1.3.2 requires the operator to run, for each essential infrastructure, a logging, correlation and analysis system operating 24 hours a day, 7 days a week. Section 4 of the Rules provides for an annual compliance control of operators of essential services by ANCy's delegate.

Titre II of Loi n° 2018-026 subjects an operator of essential services to cybersecurity rules that protect its essential infrastructure. The Act defines an operator of essential services as any public or private operator offering a service essential to the functioning of society or the economy whose continuity could be gravely affected by an incident touching the electronic communications networks or information systems needed to provide it.

Article 3 leaves which operators receive that designation, and how essential infrastructure is determined, to a decree in Council of Ministers. The same Article leaves the content of the cybersecurity rules those operators must follow to a decree in Council of Ministers as well. Article 6 creates the Agence nationale de la cybersécurité (ANCy) as a public legal person with financial autonomy. ANCy designates the operators of essential services.

ANCy fixes the protective measures an operator of essential services must implement to secure its essential infrastructure, and controls the operator's compliance with them through inspections. ANCy grants or withholds an operator's accreditation based on that compliance. ANCy collects technical information about an incident affecting an operator's essential infrastructure.

ANCy may impose astreintes or sanctions, including monetary ones, on an operator that does not meet its cybersecurity obligations. The modalities of control and the sanctions applicable for non-compliance are themselves left to a decree in Council of Ministers. ANCy also certifies hardware, software and IT services for their capacity to perform cybersecurity functions.

Article 21 permits, once a work has been lawfully made accessible to the public and provided the work's title and the author's name are mentioned, short analyses and quotations taken from it, including quotations of newspaper and periodical articles in the form of a press review, where they conform to fair usage and are justified by a scientific, critical, polemical, teaching or informational purpose; such quotations and analyses may be used in the original or in translation.

Article 22 separately permits reproducing by the press, or broadcasting, for informational purposes, political, social or economic news articles published in their original form or in translation, and speeches delivered in public at official ceremonies or at political, judicial, administrative or religious meetings and assemblies. This is on condition that the author's name and the source are mentioned and that the right of reproduction has not been expressly reserved.

Neither article caps the quotation or the reproduction at a headline-length or short-extract threshold beyond the fair-usage and informational-purpose tests, and no reported Togolese decision applies either article to a systematic aggregator's reproduction of headlines and snippets, as opposed to an individual quotation or a traditional press review.

Togo has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright and the law's civil seizure remedies, and no located case law on hyperlinking or framed display.

Article 120, the closing article, orders publication in the Journal officiel and execution as a law of the State but names no day of the law's own entry into force, and no commencement notice has been located in the Journal officiel.