Law: Law No 2008-12 of 25 January 2008 Concerning Personal Data Protection ('the Law') and Decree No 2008-721 of 30 June 2008 Concerning Law Enforcement, Relating to Application of the Data Protection Law (only available in French here)
Regulator: Senegalese data protection authority ('CDP')
Summary: The Law provides an essential data protection framework, including requiring data processing notifications, setting out fundamental data subject rights, and regulating data transfers. The Law does not, however, establish breach notification requirements or address matters such as data protection officer appoints. There is a draft law that would amend the Law that currently being considered by the CDP which would introduce, among other things, principles of authentication, identification, and anonymisation. The CDP enforces the Law and is relatively active in issuing press releases updating on its recent activities and meetings, as well as guidance on the implementation of the Law. In particular, the CDP publishes detailed quarterly activity reviews which cover, among other things, all complaints, investigations, authorisation applications for data processing, and key developments.