Free whiteglove setup from a ConsentStack Concierge

Law 2017-020

Law No. 2017-020 of July 22, 2017 on the Protection of Personal Data

Flag of MR
Islamic Republic of MauritaniaOpt-inSub-Saharan AfricaNational
Back to Regulations Guide

Key Facts

Effective Date
July 22, 2017
Enacted
July 22, 2017
Enforcing Authority
Autorite de Protection des Donnees a caractere Personnel (APD)
Consent Model
Opt-in
Applies To
All entities processing personal data within Mauritania

Overview

Mauritania enacted Law 2017-020 in July 2017 to establish a comprehensive data protection framework. The law created the Autorite de Protection des Donnees a caractere Personnel (APD) as the supervisory authority. Mauritania holds a distinctive place in African data protection history as the 15th country to ratify the AU's Malabo Convention, which triggered the convention's entry into force continent-wide in June 2023.

What This Means for Your Website

If your website collects personal data from individuals in Mauritania, you must obtain opt-in consent before processing. Organizations must maintain detailed records of all processing activities and notify both the APD and affected individuals in the event of a data breach. Cross-border data transfers are restricted to countries with adequate protection levels. While enforcement capacity is still developing, compliance demonstrates respect for the legal framework.

Key Requirements

Consent is the primary legal basis for processing personal data. Data subjects have rights to information, access, correction, and deletion of their data. Breach notification must be sent to both the APD and affected individuals. Organizations are required to maintain detailed processing records. Cross-border transfers must meet adequacy requirements in the recipient country. Specific penalty amounts are not publicly detailed, but the law provides for monetary fines and operational restrictions.

How ConsentStack Handles This

ConsentStack geo-detects visitors from Mauritania and displays an opt-in consent banner before any non-essential data collection begins. Consent records are stored with full timestamps and preference details for audit purposes. The platform helps you maintain the processing documentation required by the law and supports breach notification workflows through its consent management infrastructure.

Penalties

Monetary fines and operational restrictions for non-compliance (specific amounts not publicly detailed)

Key Requirements

  • Consent required for personal data processing
  • Data subjects have rights to information, access, correction, and deletion
  • Organizations must notify APD and affected individuals of data breaches
  • Detailed processing records must be maintained
  • Cross-border transfers subject to adequacy requirements
  • Data security measures mandatory

Notable Provisions

  • Mauritania's ratification was the 15th, triggering the Malabo Convention's entry into force
  • APD established as supervisory authority but enforcement capacity remains limited
  • Breach notification required to both the authority and affected individuals

Other Sub-Saharan Africa Regulations

POPIASouth Africa
Africa's most developed and actively enforced data protection law. POPIA establishes eight conditions for lawful processing and grants the Information Regulator broad enforcement powers including criminal sanctions. The inclusion of "online identifiers" in the definition of personal information means cookies are covered, and Section 69's direct marketing consent requirement is directly relevant to consent management.
NDPANigeria
One of Africa's most comprehensive data protection laws, with the GAID providing Africa's most detailed cookie consent framework. Essential cookies are exempt; non-essential cookies require conspicuous accept/reject banners. The NDPC enforces a two-tier penalty structure based on organizational significance.
Kenya DPA 2019Republic of Kenya
Kenya's comprehensive data protection law establishes the ODPC as an independent enforcement authority. It uniquely calculates penalties using "whichever is lower" rather than the global norm of "whichever is higher." Mandatory registration of data controllers is required before processing, and consent serves as the primary legal basis for personal data collection.
Ghana Act 843Ghana
Ghana's foundational data protection law requires mandatory registration with the DPC before processing begins, with renewal every 2 years. Criminal penalties include up to 10 years imprisonment for serious violations. A new comprehensive bill is under consultation as of late 2025.
Ivory Coast Law 2013-450Ivory Coast
Ivory Coast's data protection law features an escalating penalty structure with significant increases for repeat offenders: up to 5% of pre-tax sales or XOF 500 million. ARTCI has been active in issuing formal notices against online lending applications. Prior declaration or authorization from ARTCI is required.
Tanzania PDPA 2022United Republic of Tanzania
Tanzania's first comprehensive data protection legislation establishes the Personal Data Protection Commission as the supervisory body. It mandates DPO appointment for all controllers and processors, a broader requirement than most jurisdictions. Personal data must be processed lawfully with consent, and criminal penalties of up to 10 years imprisonment apply for violations.

Frequently Asked Questions

Stay compliant with Law 2017-020

ConsentStack helps you implement Opt-in consent for Islamic Republic of Mauritania automatically.

Get started free