Senegal - Law No. 2008-12 on Personal Data Protection (2008)

Senegal enacted Law No. 2008-12 on 25 January 2008, among the first data protection laws in Africa, implemented by Decree No. 2008-721 of 30 June 2008. It establishes the Commission de protection des Donnees Personnelles (CDP), an independent authority that receives prior formalities, handles complaints, conducts on-site, documentary and hearing inspections, and sanctions controllers. Processing must generally be declared to the CDP; prior authorisation is required for sensitive processing (genetic data, biometric data, offence-related data, national identification numbers, file interconnections and public-interest processing), and State processing requires a reasoned CDP opinion. Consent is the default legal basis, with exemptions for legal obligations, public interest, contract and vital interests.

Cross-border transfers are prohibited unless the receiving country ensures sufficient protection, and the CDP must be informed before any transfer. There is no mandatory breach notification and DPO appointment is discretionary for businesses. Senegal was the first African country to ratify the African Union's Malabo Convention on Cyber Security and Personal Data Protection, in 2016. A modernising bill published in late 2019, which would replace the CDP with a new authority and address biometrics, big data and AI, has not been adopted, so the 2008 law remains in force as of 2026.