The Beninese data protection authority ('APDP') released, on 12 April 2022, a communiqué regarding obligations for data controllers for the collection and processing of personal data. In particular, the APDP stated that, in accordance with Article 415 of Law No. 2017-20 of 20 April 2018, as amended by Law 2020-35 of 6 January 2021 on the Digital Code, data controllers are required to give individuals whose data is the subject of the processing, at the latest during collection, by whatever means and support tools used, and at least through easily legible notices or downloadable files, information on the data controller, including:

• their identity and address, or, where applicable, the contact details of their representative;
• where applicable, the contact details of the data protection officer;
• the specified purpose(s) of the processing for which the data is collected, in cases where the processing is based on the legitimate interests pursued by the data controller or a third party;
• the categories of data;
• the recipient(s) to whom the data may be disclosed;
• data subject rights, such as the right of access, to object, to erasure and rectification, and to withdraw consent;
• data retention periods; and
• the possibility of data transfers to third countries.

To this end, the APDP specified that the content of the above information through any means or support tool must comply with, or be approved by, the APDP. Lastly, the APDP noted that, for the processing of personal data via a website, the data controllers are required to include the above information in legal notices on the respective website.

You can read the communiqué, only available in French, here.