Law: Act No. 001-2021/AN of 30 March 2021 (only available in French here) ('the 2021 Act')

Regulator: Burkina Faso data protection authority ('CIL')

Summary: Burkina Faso enacted Law No. 010-2004/AN on the Protection of Personal Data (only available in French here) in 2004, making it one of the earliest adopters of a modern data protection law in the region. The 2021 Act which was adopted on 21 April 2021, repealed and replaced the 2004 Act. The 2021 Act strengthens the protection of the privacy of individuals, including by broadening its geographical scope to offshore data controllers who carry out processing operations from Burkina Faso (irrespective of whether they use local means of processing), by supervising transborder transfers, and by providing a more comprehensive right to be informed. In addition, the 2021 Act reinforces security requirements with the obligation, where data is transferred to a third country, to enter into a contract with the data recipient that includes a return of data clause and to encrypt the data, and introduces the principle of data localisation with the obligation to host health data in Burkina Faso unless an exemption is granted by the CIL. The CIL is the independent administrative authority in charge of compliance with the Law and although it has the power to prosecute any breach of the Law, it is not considered to be particularly active. Burkina Faso had its application to accede to Convention 108 accepted on 23 March 2017, however it has yet to ratify Convention 108.