Law: Law No. 2013/015 of 23 May 2013 on the Protection of Personal Data in the Republic of Mali (only available in French here) (the Law)

Regulator: Malian data protection authority (APDP)

Summary: In Mali, personal data protection is regulated by Law No. 2013/015 of 23 May 2013 on the Protection of Personal Data in the Republic of Mali (only available in French here) (the Law), partially amended by Law No. 2017-070 of December 18, 2017. The Law applies to both public and private bodies, and to all processing of data in the Malian territory or in a place where Malian laws apply. The Law establishes limited obligations on data controllers and processors, including in relation to data processing notifications, data transfers, and data retention. It also provides data subjects with certain rights, such as the right to be informed and the right of access.

The regulatory authority for data protection in Mali is the Malian data protection authority (APDP). The APDP has extensive powers and duties, including to issue guidelines and to impose administrative sanctions of non-monetary nature. Criminal sanctions (imprisonment or fines) for non-compliance with the Law may be imposed by a judge. Fines may range between XOF 2.5 million (approx. $4,016) and XOF 20 million (approx. $32,116).

Mali is a signing member of the Economic Community of West African States (ECOWAS) Supplementary Act A/SA. 1/01/10 on Personal Data Protection within ECOWAS (the Act).