Law: Law No. 2017 - 020 on the protection of the personal data

Regulator: Personal Data Protection Authority 

Summary: On June 22, 2017, Mauritania adopted Law No. 2017 - 020 on the protection of the personal data (the Law) which, however, has not yet come into effect. The Law sets out requirements for data processing as well as data subject rights, and establishes the Mauritanian Data Protection Authority (APD), which is not yet operational. The Law applies to any processing of personal data by individuals and public and private organizations, and does not have extraterritorial application. Under the Law, personal data can only be processed with the consent of the data subject, with some exceptions. In terms of penalties, the Law provides for penalties of up to MRU 50,000,000 (approx. $1,272,260) for the violation of its provisions. Mauritania deposited its ratification instrument for the African Union Convention on Cyber Security and Personal Data Protection on May 9, 2023.