Is your customer data protected?
Your business collects names, phone numbers, email addresses, and possibly even financial data through Mobile Money. You store this information in an Excel file, a CRM, or on your sales team's phones.
But do you have a data protection policy? Do you know what the law requires of you? What are the risks in the event of a breach?
In 2026, ignoring personal data protection is no longer an option — it's a legal, financial, and reputational risk for your business.
Africa has its own laws
42 countries, 39 supervisory authorities
Contrary to popular belief, Africa is not a regulatory desert when it comes to personal data. 42 African countries now have dedicated legislation, and 39 supervisory authorities are fully operational.
The continent's pioneers
Some African countries passed legislation even before the European GDPR:
- Cape Verde — as early as 2001, first African country
- Sénégal — law n°2008-12 of January 25, 2008
- Tunisia and Morocco — laws adopted between 2004 and 2009
- Benin — solid legal framework since 2017
The Malabo Convention: Africa's GDPR
Adopted in 2014 by the African Union and entered into force on June 8, 2023 following 15 ratifications, the Malabo Convention is the continent's reference framework. It covers:
- Personal data protection
- Cybersecurity and the fight against cybercrime
- Electronic transactions
- Digital governance
For businesses, this means a progressive harmonization of rules across the continent — facilitating cross-border trade while strengthening protection obligations.
In Sénégal: what does the law say?
The 2008 Personal Data Law
Sénégal has a solid legal framework with law n°2008-12 on the protection of personal data. This law requires:
- Consent — you must obtain the explicit agreement of individuals before collecting their data
- Purpose — data may only be used for the reason stated at the time of collection
- Security — you must protect data against unauthorized access
- Retention — data cannot be kept indefinitely
- Rights — any individual may request access to, modification of, or deletion of their data
The CDP: the supervisory authority
The Commission des Données Personnelles (CDP) is the Senegalese authority responsible for enforcing the law. It can conduct audits, receive complaints, and issue sanctions.
Key obligation: any business that processes personal data must file a prior declaration with the CDP before beginning processing.
Why this matters for your SME
1. Legal risk
Failing to comply with the law exposes you to administrative and financial penalties. With supervisory authorities across Africa growing stronger, audits are becoming more frequent.
2. Reputational risk
A customer data breach can destroy the trust you have spent years building. In a market where word of mouth is king, a damaged reputation spreads fast.
3. Competitive advantage
Conversely, a business that clearly displays its data protection policy inspires trust. It's a commercial asset, especially when dealing with international clients accustomed to the GDPR.
4. Partner requirements
A growing number of large corporations and international organizations require their suppliers and partners to meet data protection standards. Non-compliance can close off markets for you.
Practical guide: 8 steps to bring your SME into compliance
Step 1: Map your data
Take stock of all the personal data you collect:
- What data? (name, phone, email, location, financial data)
- Through which channel? (web form, WhatsApp, in person)
- Where is it stored? (Excel, CRM, phone, cloud)
- Who has access?
Step 2: Define a legal basis
For each type of data, identify why you collect it and on what legal basis (consent, contract, legal obligation).
Step 3: Inform individuals
Draft a clear privacy policy that explains:
- What data you collect and why
- How it is protected
- How long it is retained
- How to exercise their rights (access, modification, deletion)
Step 4: Secure storage
- Encrypt sensitive files
- Use strong passwords and MFA
- Restrict access to the strictly necessary
- Avoid storing customer data on unsecured personal phones
Step 5: Define retention periods
Do not keep data indefinitely. Define a maximum retention period for each category, then delete it securely.
Step 6: File your declaration with the CDP
In Sénégal, declare your data processing activities with the Commission des Données Personnelles. This is a legal obligation that is often overlooked.
Step 7: Train your teams
Your employees who handle customer data must know the basic rules: no sharing customer files via personal WhatsApp, no passwords on sticky notes, no connecting on public Wi-Fi.
Step 8: Prepare a breach response plan
If a data breach occurs:
- Who is responsible for managing the crisis?
- Should the CDP and affected individuals be notified?
- How do you limit the damage?
The European GDPR applies to you too
If your business:
- Has customers in the European Union
- Uses tools hosted in Europe (Brevo, OVH, etc.)
- Works with European partners
Then the GDPR also applies to you, even if you are based in Sénégal. Fines can reach 4% of global annual turnover.
Conclusion: compliance starts now
Data protection is not a topic reserved for large corporations or multinationals. With 42 African countries equipped with laws, the Malabo Convention in force, and supervisory authorities growing increasingly active, every African SME must take this seriously.
The good news: the first steps are simple and free. Start by mapping your data and informing your customers.
Need help bringing your business into compliance? Rostel High-Tech supports you in securing your data and implementing best practices. Let's talk.
Sources: Africa Data Protection 2025, Malabo Convention (African Union), CDP Sénégal — Law n°2008-12, Leto.legal — GDPR in Africa 2025.
