Law: Act No. 001-2021/AN of 30 March 2021 (only available in French here) (the 2021 Act)

Regulator: Burkina Faso data protection authority (CIL)

Summary: The Act No. 001-2021/AN of 30 March 2021 (the 2021 Act) was adopted on April 21, 2021, replacing the Law No. 010-2004/AN on the Protection of Personal Data. The 2021 Act strengthens the protection of the privacy of individuals, including by broadening its geographical scope to offshore data controllers who carry out processing operations from Burkina Faso (irrespective of whether they use local means of processing), by supervising transborder transfers, and by providing a more comprehensive right to be informed. In addition, the 2021 Act reinforces security requirements with the obligation, where data is transferred to a third country, to enter into a contract with the data recipient that includes a clause regarding the return of data and the encryption of data, and introduces the principle of data localization with the specific obligation to host health data in Burkina Faso unless an exemption is granted by the Commission for Information Technology and Freedoms (CIL). The CIL is the independent administrative authority in charge of compliance with the Law and, although it has the power to prosecute any breach of the Law, it is not considered to be particularly active. Burkina Faso had its application to accede to Convention 108 accepted on March 23, 2017, however it has yet to ratify Convention 108. Burkina Faso is part of the Economic Community of West African States (ECOWAS), therefore subject to the Supplementary Act A/SA.1/01/10 on Personal Data Protection within ECOWAS.