Burkina Faso data protection act

March 2021

View the original document

National Regulations

The Burkina Faso Law No. 001-2021/AN on the protection of individuals regarding the processing of personal data is a comprehensive legal framework that aims to safeguard the rights and freedoms of individuals in the context of personal data usage. Enacted by the National Assembly on 30 March 2021, this law updates and strengthens data protection regulations, replacing Law No. 010-2004/AN of 20 April 2004, to address modern technological and legal challenges.

Purpose of the law

The primary objectives of the law are to:

  • Protect individuals’ rights, including their privacy and freedoms, in the processing of personal data.
  • Provide guidelines for the ethical, transparent, and lawful handling of data.
  • Ensure accountability among entities that process personal data, reinforcing trust in the use of technology.

Scope of the law

The law applies broadly to:

  1. Data processing activities are conducted within Burkina Faso by controllers or processors.
  2. Entities outside Burkina Faso are processing data that targets individuals within the country in line with international public law.
  3. Both automated and non-automated data processing, including those involving electronic communications.

Exemptions under the law

The law does not regulate:

  • Data is processed solely for personal or domestic activities.
  • Temporary data copies are used for technical transmission or short-term storage, provided they are deleted after use.
  • Data processing for artistic, literary, or journalistic purposes, where these adhere to ethical and professional standards.

Principles guiding the law

The law is based on several key principles:

  1. Lawfulness and fairness: Data must be collected and processed fairly and legally.
  2. Purpose limitation: Data should be collected only for specific, explicit, and legitimate purposes.
  3. Data minimisation: Only data relevant and necessary for the purpose should be collected.
  4. Accuracy and security: Data must be kept accurate, updated, and secure from unauthorised access or misuse.