Données publiques
Lois sur la protection des données et permis de recherche en Afrique, par pays
Qui autorise une enquête, quelle loi de protection des données s’applique et qui la réglemente, pour 54 pays africains.
Comment utiliser ceci
Planifier un travail de terrain en Afrique suppose généralement deux vérifications. D’abord, découvrez quel organisme doit autoriser l’enquête, souvent l’institut national de la statistique. Ensuite, vérifiez si le pays dispose d’une loi sur la protection des données, qui la réglemente, et si vous devez vous enregistrer avant de collecter des données personnelles. Trouvez votre pays dans le tableau, puis ouvrez sa page pour obtenir les liens vers l’autorité de régulation, l’organisme d’autorisation et l’institut de la statistique. Lorsqu’un champ n’a pas d’entrée officielle, le tableau indique « Non répertorié ».
Résumé pour la planification ; confirmez les exigences auprès du régulateur avant le travail de terrain.
- 23 régulateur opérationnel
- 13 loi adoptée, autorité de régulation non confirmée comme opérationnelle
- 12 aucune loi identifiée
- 6 non classé dans l’assurance qualité de la source
Régulateur opérationnel (23)
Une loi sur la protection des données est en vigueur et un régulateur est en activité.
| Pays | Loi sur la protection des données | Régulateur | Inscription obligatoire ? | Organisme chargé des permis d’enquête |
|---|---|---|---|---|
| Algérie | Law 18-07 on the protection of natural persons in the processing of personal data (2018) | ANPDP (Autorite Nationale de Protection des Donnees a caractere Personnel) | prior declaration or authorization for processing | ONS authorization required under the statistics law |
| Bénin | Law 2017-20 on the digital code (personal data protection section) (2017) | APDP (Autorite de Protection des Donnees a caractere Personnel) | declaration to APD required before processing | INStaD authorization required under Law 2010-35 on statistics |
| Botswana | Data Protection Act 2018 (Act 32 of 2018) (2018) | Data Protection Commissioner (Office of the Data Protection Commissioner) | registration of data controllers and processors required | Statistics Botswana permit required under the Statistics Act 2009 |
| Cabo Verde | Law 133/VI/2001 on personal data protection, amended by Law 57/VIII/2021 (2001) | CNPD (Comissao Nacional de Protecao de Dados) | notification to CNPD required for processing | INE authorization required under the statistics law (Lei 50/VI/2005 as amended) |
| Égypte | Law 151 of 2020 on the protection of personal data (2020) | Egyptian Data Protection Centre (EDPC) under MCIT | licensing/registration of data processing platforms via EDPC | CAPMAS permit required under Law 175 of 2018 on statistics |
| Gabon | Law 001/2011 on data protection in electronic communications (2011) | CNPD (Commission Nationale de Protection des Donnees) | declaration to CNPD required | DGS authorization required under the statistics law |
| Gambie | Data Protection Act 2021 (2021) | Data Protection Commission (established 2023) | registration of data controllers and processors required | GBoS permit required under the Statistics Act 2005 |
| Ghana | Data Protection Act 2012 (Act 843) (2012) | Data Protection Commission (Ghana) | registration of data controllers required | GSS permit required under the Statistical Service Act 2019 (Act 1003) |
| Kenya | Data Protection Act 2019 (2019) | Office of the Data Protection Commissioner (ODPC) | registration of data controllers and processors required (exemptions by regulation) | KNBS research license required under the Statistics Act 2006 (research license regime) |
| Malawi | Data Protection Act 2024 (Act 6 of 2024) (2024) | Data Protection Authority (provided for by the Act) | registration regime under the Act; authority being stood up | NSO permit required under the Statistics Act 2013 |
| Mauritanie | Law 2017-020 of 22 July 2017 on personal data protection (2017) | APD (Autorite de Protection des Donnees a caractere Personnel), operational since decree 2022-13 of 18 February 2022 | declaration/authorization regime before the APD | ONS authorization required under Ordinance 2005-026 on statistics |
| Maurice | Data Protection Act 2017 (2017) | Data Protection Office | registration of data controllers required | Statistics Mauritius authorization required under the Statistics Act 2000 |
| Maroc | Law 09-08 on the protection of individuals with regard to personal data processing (2009) | CNDP (Commission Nationale de controle de la protection des Donnees a caractere personnel) | prior declaration to CNDP required | HCP authorization required under Law 06-99 on statistics |
| Nigeria | Nigeria Data Protection Act 2023 (2023) | Nigeria Data Protection Commission (NDPC) | registration of data controllers of major importance required | NBS permit required for statistical surveys; NDPC clearance for personal data processing in research |
| Sénégal | Law 2008-12 on personal data protection (2008) | CDP (Commission de protection des Donnees personnelles) | prior declaration to CDP required | ANSD authorization required under Law 2004-21 on statistics |
| Seychelles | Data Protection Act 2003, amended by the Data Protection (Amendment) Act 2023 (2003) | Information Commissioner's Office | notification/registration regime under the Act | NBS authorization required under the Statistics Act 2000 |
| Sierra Leone | Data Protection Act 2021 (Act 5 of 2021) (2021) | National Data Protection Commission (NDPC) | registration of data controllers required | SSL permit required under the Statistics Act 2002 |
| Afrique du Sud | Protection of Personal Information Act 4 of 2013 (POPIA) (2013) | Information Regulator (South Africa) | registration of information officers required; deputy information officers for research bodies | Stats SA accreditation required for research access; ethical clearance via research ethics bodies |
| Togo | Law 2019-014 of 29 October 2019 on personal data protection (2019) | IPDCP (Instance de Protection des Donnees a Caractere Personnel) | declaration to IPDCP required; designated data correspondents exempted from prior formalities | DGSCN authorization required under the statistics law |
| Tunisie | Organic Law 2004-63 on personal data processing (2004) | INPDP (Instance Nationale de Protection des Donnees a Caractere Personnel) | prior authorization by INPDP required | INS authorization required under Law 1964-93 on statistics |
| Ouganda | Data Protection and Privacy Act 2019 (2019) | Personal Data Protection Office (PDPO) | registration of data controllers and processors required | UBOS clearance required under the Uganda Bureau of Statistics Act 1998; research also requires UNCST registration |
| Zambie | Data Protection Act No. 3 of 2021 (2021) | Data Protection Commissioner (under the Ministry of Technology and Science) | registration of data controllers and processors required | ZamStats permit required under the Statistics Act 2018 |
| Zimbabwe | Cyber and Data Protection Act 2021 (Act 5 of 2021) (2021) | Data Protection Authority provided for by the Act; operational status limited | registration of data controllers under the Act | ZIMSTAT permit required under the Census and Statistics Act 2017 |
Loi adoptée, autorité de régulation non confirmée comme opérationnelle (13)
Une loi est adoptée. Un régulateur actif n’est pas encore répertorié.
| Pays | Loi sur la protection des données | Régulateur | Inscription obligatoire ? | Organisme chargé des permis d’enquête |
|---|---|---|---|---|
| Angola | Law 22/11 of 17 June 2011 on personal data protection (2011) | Agencia de Protecao de Dados (APD) | prior authorization by the APD for processing | INE authorization required under the statistics framework law |
| Burundi | Law 1/09 on the protection of personal data (reported) (2009) | not confirmed (no operational authority identified) | not confirmed | ISTEEBU authorization required under Law 1/015 of 2009 on statistics |
| Cameroun | Law 2024/017 of 23 December 2024 on personal data protection (2024) | authority provided for by the 2024 law; implementation decrees pending (not confirmed) | declaration/authorization regime under the 2024 law; modalities pending | BUCREP authorization required for censuses and population studies; NSO function shared with INS |
| Tchad | Law 020/PR/2015 on cybersecurity and data protection (reported) (2015) | not confirmed (no operational authority identified) | prior declaration regime under the law; implementation unclear | INSEED authorization required under Law 05-17 of 2005 on statistics |
| Congo | Law 29-2019 of 28 October 2019 on personal data protection (2019) | Commission de Controle et de Protection des Donnees a caractere Personnel (provided for by the law) | prior declaration to the authority required | CNSEE authorization required under Law 14-94 on statistics |
| RD Congo | Law 20/017 of 8 July 2020 on personal data protection (2020) | Autorite de Protection des Donnees a caractere Personnel (provided for by the law) | prior declaration/authorization regime under Law 20/017 | INS authorization required under the statistics law (Loi 81-006) |
| Guinée équatoriale | Law 1/2016 on the protection of personal data (2016) | Organo Rector de Proteccion de Datos Personales (provided for by the law) | registry of data files (Registro General de Proteccion de Datos Personales) under the law | INE authorization required; regime not confirmed in practice |
| Eswatini | Data Protection Act, 2022 (reported) (2022) | Data Protection Commissioner (provided for by the Act) | registration regime under the Act; implementation not confirmed | CSO permit required under the Statistics Act 1967 (as amended) |
| Éthiopie | Personal Data Protection Proclamation No. 1321/2024 (2024) | provided for under the proclamation (Ethiopian Communications Authority roles); details pending | registration/notification regime under the proclamation; implementing rules pending | ESS authorization required under the Ethiopian Statistics Service Proclamation 1262/2021 |
| Guinée | Law 2016-037/AN on cybersecurity and personal data protection (2016) | authority provided for by regulatory decree; establishment not confirmed effective | prior declaration or authorization required by law; implementing decree pending | INS authorization required under the statistics law |
| Niger | Law 2017-64 on the protection of personal data (2017) | CNDP (Commission Nationale de Protection des Donnees a caractere Personnel) | declaration/authorization regime under the law | INS authorization required under Law 2015-25 on statistics |
| Sao Tomé-et-Principe | not confirmed (no comprehensive law identified) | Not listed | Not listed | INE authorization required under the statistics framework law |
| Tanzanie | Personal Data Protection Act 2022 (Act 11 of 2022) (2022) | data protection authority provided for by the Act; operational status not confirmed | registration regime under the Act | NBS permit required under the Statistics Act 2015 |
Aucune loi identifiée (12)
Aucune loi nationale sur la protection des données n’est répertoriée.
| Pays | Loi sur la protection des données | Régulateur | Inscription obligatoire ? | Organisme chargé des permis d’enquête |
|---|---|---|---|---|
| République centrafricaine | not confirmed (no comprehensive law identified) | Not listed | Not listed | no formal permit regime confirmed; field research requires government authorization in practice |
| Comores | not confirmed (no comprehensive law identified) | Not listed | Not listed | INSEED authorization required under the statistics law |
| Djibouti | not confirmed (no comprehensive law identified) | Not listed | Not listed | authorization from the statistics department required; regime not confirmed |
| Érythrée | none identified | Not listed | Not listed | no formal research permit regime; independent field research is effectively not permitted |
| Guinée-Bissau | none identified | Not listed | Not listed | INE authorization required under the statistics framework law (Lei 9/2012, confirmed via AFRISTAT mirror) |
| Libéria | none enacted (draft data protection bill pending) | Not listed | Not listed | LISGIS permit required under the Statistics and Geo-Information Act 2019 |
| Libye | none identified (cybercrime law 2022 contains partial provisions) | Not listed | Not listed | no functioning permit regime confirmed |
| Mozambique | no comprehensive law identified (partial provisions in the 2017 Law on Electronic Transactions) | Not listed | Not listed | INE authorization required under the statistics law |
| Namibie | none enacted (draft data protection bill under consultation) | Not listed | Not listed | NSA authorization required under the Statistics Act 2011 |
| Somalie | not confirmed (draft data protection law reported) | Not listed | Not listed | no formal permit regime confirmed; survey work coordinated with line ministries |
| Soudan du Sud | none identified | Not listed | Not listed | NBS authorization required under the Statistics and Census Act 2015; conflict conditions restrict fieldwork |
| Soudan | none identified | Not listed | Not listed | CBS authorization required under the Statistics Act; conflict conditions restrict fieldwork |
Non classé dans l’assurance qualité de la source (6)
La loi et le régulateur ci-dessous sont tels qu’enregistrés dans les sources officielles. Aucun statut n’est attribué.
| Pays | Loi sur la protection des données | Régulateur | Inscription obligatoire ? | Organisme chargé des permis d’enquête |
|---|---|---|---|---|
| Burkina Faso | Law 010-2017/CNT on the protection of personal data (2017) | CIL (Commission de l'Informatique et des Libertes) | prior declaration to the CIL required | INSD authorization required under the statistics law |
| Côte d’Ivoire | Law 2013-450 on the protection of personal data (2013) | ARDP (Autorite de Regulation des Donnees a caractere Personnel) | prior declaration to ARDP required | INS authorization required under the statistics law |
| Lesotho | Data Protection Act 2011 (2011) | no dedicated authority operational (Ministry of Communications roles) | registration regime under the Act; enforcement limited | BoS permit required under the Statistics Act 2001 |
| Madagascar | Law 2014-038 on the protection of personal data (2014) | CNDP (Commission Nationale de l'Informatique et des Libertes, per the law) | declaration regime under the law | INSTAT authorization required under the statistics law |
| Mali | Law 2013-015 on the protection of personal data (2013) | CNDP (Commission Nationale de l'Informatique et des Libertes) | prior authorization/declaration required | INSTAT authorization required under the statistics law |
| Rwanda | Law 058/2021 of 8 October 2021 on personal data protection and privacy (2021) | NCSA (National Cyber Security Authority), data protection and privacy unit | registration of data controllers and processors with NCSA required | NISR authorization required under Law 45/2013 on statistics |
Sources : le régulateur, l’institut de la statistique et les textes juridiques liés dans chaque ligne, consultées 10 octobre 2026. Voir nos méthodes. Vous préparez une enquête ? Contactez-nous.
Citer cette page
PollsAfrica (2026). Lois sur la protection des données et permis de recherche en Afrique, par pays. Consulté le 10 octobre 2026 sur https://pollsafrica.com/fr/research-rules