HR data protection in Senegal covers everything an employer holds on its staff: an identifier, a salary, contributions, sometimes health data and, increasingly, a fingerprint or photo for time clocking. This processing is governed by a law and supervised by an independent authority, the Commission de protection des données personnelles (CDP, the personal data protection commission). Most companies discover it the day they roll out biometric clocking or software hosted abroad. This guide summarises what the law requires of employers, article by article, and the practical steps to take.
Which law governs HR data protection in Senegal?
The reference text is Law No. 2008-12 of 25 January 2008 on the protection of personal data, supplemented by an implementing decree from 2008. It applies to any collection, processing, transmission, storage and use of personal data by an individual, the State or a public or private legal entity (Article 2). Payroll software, a recruitment tool, a clocking system or a simple employee spreadsheet all fall within its scope.
The law creates the CDP, an independent administrative authority responsible for ensuring that processing complies with the law (Article 5). A revision has been discussed for several years to address biometrics, cloud computing and artificial intelligence; at the time of writing, the 2008 law remains in force. Information and forms are available on the CDP website, and the full text on WIPO Lex (in French).
Does the law apply to a foreign provider?
This is the most frequent question now that tools are online. The law applies to any processing carried out by a controller, whether or not established in Senegal, that uses processing means located in Senegal, other than for mere transit. In that case, the controller must appoint a representative established in Senegal (Article 2).
For employers, the main issue lies elsewhere: as controller of its HR data, the employer answers for its providers. The law requires a written contract with the processor, who may act only on instructions and must apply the security measures (Article 39). Any transfer to a third country is allowed only if that country ensures an adequate level of protection, after prior notice to the CDP (Article 49).
Questions to ask any provider: where is my HR data hosted, who can access it, which transfers outside Senegal are planned, and what does the contract say about security and confidentiality?
Declaration or authorisation: which formality with the CDP?
The law sets out several regimes depending on the nature of the processing.
| Regime | HR processing concerned | Time limit set by law |
|---|---|---|
| Declaration (Article 18) | General case: personnel management, payroll, recruitment | Receipt issued within one month, extendable once; processing may start only once it is received |
| Simplified standards (Article 19) | Common categories for which the CDP publishes standards that lighten or remove the declaration | As set by the published standard |
| Authorisation (Article 20) | Biometric data, national identification number or other general identifier, data on offences, interconnection of files | Decision within two months, extendable once; failing a decision, authorisation is deemed granted (Article 23) |
Check with the CDP whether a simplified standard already covers your personnel management processing: that is the most favourable situation. Either way, keep a copy of the receipt or authorisation in your HR data protection file, alongside the list of processing it covers.
Does all HR data have the same status?
No, and this is the main source of error in HR data protection. An HR file mixes several categories.
- Identity, contact details, salary, contributions: ordinary personal data, with restricted access.
- Medical certificates and sick notes: health data. Processing it is prohibited in principle (Article 40), except in cases provided by law, including the person’s written consent or the need to defend a legal claim (Article 41).
- Fingerprints or facial recognition: biometric data, subject to prior authorisation by the CDP (Article 20).
- Opinions, trade union membership, origin: data whose collection is prohibited in principle (Article 40). An HR form should not ask for it.
- Reviews and appraisals: ordinary data, but covered by the employee’s right of access.
Biometric clocking and HR data protection
Yes, but not on an internal decision alone. This is the most poorly anticipated point in projects: a fingerprint or facial recognition device is often presented as a technical feature, when it falls under the authorisation regime. Treat the CDP application as a project step, with its own lead time, not as a formality after go-live.
Also question the real need, since the law requires data to be adequate, relevant and not excessive for the purpose (Article 35). A non-biometric alternative (badge, code, mobile clocking geolocated at the workplace) avoids this constraint entirely. See our guide to time-clocking software in Senegal.
What rights do employees have over their data?
- Right to information (Article 58): at collection, employees must be told who the controller is, the purposes, the recipients, the retention period and any transfers abroad.
- Right of access (Articles 62 and 63): they can ask in writing for the data held about them and obtain a copy.
- Right to object (Article 68): on legitimate grounds, except where processing meets a legal obligation, such as social security returns.
- Right to rectification and erasure (Article 69): the employer must show, free of charge, that corrections were made within one month of the written request.
A system where files are scattered across paper, a shared drive and inboxes makes these answers impossible within the deadlines. This is the direct link between HR data protection and organisation: see our article on the HR digital vault.
HR data protection obligations: confidentiality, security, retention
Confidentiality
Processing is confidential and reserved for people acting under the controller’s authority, who must sign a written undertaking to comply with the law (Article 70). Plan for this with your HR and payroll team.
Security
The employer takes every useful precaution given the nature of the data (Article 71), in particular so that each authorised person accesses only the data within their remit, and so that it can be checked afterwards who viewed what, and when.
Retention
Data must not be kept longer than necessary for its purpose (Article 35). Set a period for each type of document, including unsuccessful applications.
What penalties does an employer face?
The CDP can issue a warning or a formal notice (Article 29). If the controller fails to comply, it can, after an adversarial procedure, withdraw the authorisation and impose a fine of one million to one hundred million CFA francs (Article 30). In urgent cases, it can suspend processing or lock data for up to three months, or prohibit the processing (Article 31). These amounts are those of the 2008 law, in force in 2026.
Seven practical HR data protection measures
- List your HR processing: what data, for what purpose, kept how long, accessible to whom.
- Check the regime for each processing (standard, declaration, authorisation) and complete the formalities.
- Restrict access by role: a manager has no need to see a medical certificate.
- Write an information notice for employees and candidates.
- Set and document retention periods.
- Bind your providers by contract, including on hosting and transfers.
- Train the people who handle this data: many incidents come from a misdirected email, not an attack.
HR data protection in Senegal: FAQ
Does payroll software need to be declared to the CDP?
Payroll is personal data processing covered by the law. Depending on the case, it falls under a simplified standard or a declaration: check with the CDP. Our HR and payroll software for Senegal centralises the data this process requires.
Can HR data be hosted outside Senegal?
Yes, if the destination country ensures an adequate level of protection and after prior notice to the CDP (Article 49). Hosting abroad does not transfer responsibility: HR data protection remains the employer’s obligation as controller.
Can an employee ask for their file to be deleted?
They can ask for inaccurate, outdated or unlawfully kept data to be corrected or erased (Article 69), but not data the employer must keep under a legal obligation.
HR data protection in Senegal: key takeaways
- Law No. 2008-12 and the CDP govern all HR data processing in Senegal.
- Declaration is the rule; biometrics and the national identifier require authorisation.
- Health data is prohibited in principle, except in cases provided by law.
- Employees have rights to information, access, objection and rectification.
- Fines range from one to one hundred million CFA francs.
Socium centralises HR documents with role-based access and traceable archiving, the foundation of sound HR data protection. Discover our HR document management or book a demo.
Want to go further?
See how Socium transforms HR and payroll practices across 12 African countries.