HR data protection in Senegal: the law

HR data protection in Senegal: what the law requires

An employee file contains an identifier, a salary, sometimes health data and, increasingly, a fingerprint. In Senegal, this processing is governed by a law and supervised by an independent authority. Most companies are unaware of it until the day they roll out biometric clocking.

Which law governs personal data in Senegal?

Law No. 2008-12 of 25 January 2008 governs the processing of personal data in Senegal. It establishes the Personal Data Protection Commission (Commission de Protection des Données Personnelles, CDP), an independent administrative authority tasked with ensuring compliance.

The law explicitly covers automated processing, which unambiguously includes payroll software, a recruitment tool or a clocking system.

Does the law apply to a foreign provider?

This is the most frequent question with the spread of online tools. The scope is broad: the law applies to a controller established in Senegal or not, as soon as it uses processing means located on Senegalese territory. In that case, a representative established in Senegal must be appointed.

The question to ask any provider: where is my data hosted, who has access to it, and what steps have you taken with the CDP? A provider with no clear answer exposes you.

Do all HR data have the same status?

No, and this is the main source of error. An HR file mixes several categories.

• Identity, contact details, salary and contributions: ordinary personal data, with restricted access
• Medical certificates and sick notes: health data, sensitive, with very limited access
• Fingerprint or facial recognition: biometric data, sensitive, reinforced regime
• Evaluations and interviews: ordinary data, but with an employee right of access to respect

Is biometric clocking allowed?

This is the most poorly anticipated point in the projects we see. A fingerprint or facial-recognition system is often presented as a simple technical feature. Legally, it is sensitive data, falling under a specific regime.

Treat the process with the CDP as a step in the project, not a formality after go-live. And ask yourself about the real need: a non-biometric alternative — badge, code, geolocated clocking — avoids this constraint entirely. See our guide to time-clocking software in Senegal.

What rights do employees have over their data?

The law grants the individuals concerned rights that the employer must be able to exercise, not merely acknowledge: responding to an employee who asks what data you hold, correcting inaccurate information, justifying the retention period.

A system where files are scattered between paper, a shared drive and mailboxes makes these responses impossible within a reasonable time. This is the direct link between compliance and organisation: see our article on HR document archiving.

Six concrete measures to put in place

1. Map your HR processing: which data, for what purpose, kept for how long, accessible to whom.
2. Restrict access by profile: a manager does not need to see a medical certificate.
3. Identify your sensitive processing and check its regime with the CDP.
4. Set and document retention periods, including for unsuccessful applications.
5. Question your providers in writing about hosting, access and the steps they have taken.
6. Train the people who handle this data: most incidents come from an accidental send, not an attack.

Key takeaways

• Law No. 2008-12 and the CDP govern the processing of HR data in Senegal
• It applies even to a provider not established in Senegal in certain cases
• An HR file mixes ordinary data and sensitive data
• Biometric clocking requires a specific process with the CDP
• Most incidents come from human error

Socium centralises HR documents with profile-based access and traceable archiving. Discover document management.