Loi 1/03 (2026)
Loi n° 1/03 du 10 mars 2026 portant protection des données à caractère personnel
Key Facts
Effective Date
March 10, 2026
Enacted
March 10, 2026
Enforcing Authority
Independent oversight authority (Ministry of Digital affairs); ARCT
Consent Model
Opt-in
Penalties
Consent-based framework with penalties.
Other Sub-Saharan Africa Regulations
POPIASouth Africa
Africa's most developed and actively enforced data protection law. POPIA establishes eight conditions for lawful processing and grants the Information Regulator broad enforcement powers including criminal sanctions. The inclusion of "online identifiers" in the definition of personal information means cookies are covered, and Section 69's direct marketing consent requirement is directly relevant to consent management.NDPANigeria
One of Africa's most comprehensive data protection laws, with the GAID providing Africa's most detailed cookie consent framework. Essential cookies are exempt; non-essential cookies require conspicuous accept/reject banners. The NDPC enforces a two-tier penalty structure based on organizational significance.Kenya DPA 2019Republic of Kenya
Kenya's comprehensive data protection law establishes the ODPC as an independent enforcement authority. It uniquely calculates penalties using "whichever is lower" rather than the global norm of "whichever is higher." Mandatory registration of data controllers is required before processing, and consent serves as the primary legal basis for personal data collection.Ghana Act 843Ghana
Ghana's foundational data protection law requires mandatory registration with the DPC before processing begins, with renewal every 2 years. Criminal penalties include up to 10 years imprisonment for serious violations. A new comprehensive bill is under consultation as of late 2025.Ivory Coast Law 2013-450Ivory Coast
Ivory Coast's data protection law features an escalating penalty structure with significant increases for repeat offenders — up to 5% of pre-tax sales or XOF 500 million. ARTCI has been active in issuing formal notices against online lending applications. Prior declaration or authorization from ARTCI is required.Botswana DPA 2024Botswana
Botswana's Data Protection Act 2024 repealed and replaced the never-operational 2018 Act, entering into force 14 January 2025. It is consent-based, implying opt-in for non-essential website cookies.Stay compliant with Loi 1/03 (2026)
ConsentStack helps you implement Opt-in consent for Burundi automatically.