Skip to content
World Watch

Data protection & privacy law in Côte d'Ivoire (2026)

Data protection in Côte d'Ivoire: comprehensive law.

Côte d'Ivoire enacted a comprehensive personal data protection law in 2013 (Law No. 2013-450), modelled on the ECOWAS Supplementary Act on Personal Data framework. ARTCI functions as the independent supervisory authority with regulatory, investigative, and sanctioning powers. The law remains in force as of 2026, with ARTCI issuing updated biometrics guidance in 2024 and operating a National Registry of Data Protection Correspondents with a January 2026 registration deadline.

Last verified Official sources first · MethodologyCompare Côte d'Ivoire with other countries

Legal framework

Law No. 2013-450 of 19 June 2013 on the Protection of Personal Data; supervised by ARTCI (Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire) via its dedicated DPA portal autoritedeprotection.ci

Key points: data & privacy in Côte d'Ivoire

  1. Primary legislation

    Law No. 2013-450 of 19 June 2013 is the comprehensive statute governing collection, processing, storage, and transfer of personal data by any public or private entity operating in Côte d'Ivoire; it establishes core principles of fairness, purpose limitation, data minimisation, and storage limitation.

    artci.ci natlex.ilo.org

  2. Supervisory authority

    ARTCI (Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire) is the designated data protection authority, operating as an independent administrative body with legal personality and financial autonomy; its data protection functions are accessible at autoritedeprotection.ci.

    autoritedeprotection.ci artci.ci

  3. Registration obligation

    Organisations must declare processing activities to ARTCI or obtain prior authorisation before processing personal data; ARTCI launched a National Registry of Data Protection Correspondents with a registration deadline of 31 January 2026, requiring designated in-house data protection contacts.

    artci.ci autoritedeprotection.ci

  4. Data subject rights

    Individuals hold rights to access, rectification, deletion, objection (including for direct marketing), and the right not to be subject to decisions based solely on automated processing that produce significant or adverse legal effects.

    artci.ci africanlegalfactory.com

  5. Cross-border transfers

    Transfers to non-ECOWAS countries require prior ARTCI authorisation and are only permitted where the recipient country provides an equivalent or higher level of data protection (Articles 7 and 26 of Law No. 2013-450); intra-ECOWAS transfers benefit from freer flow under the ECOWAS Supplementary Act.

    artci.ci dataprotection.africa

  6. Sanctions

    ARTCI may impose fines up to 10,000,000 CFA francs for violations; repeat breaches within five years attract fines up to 100,000,000 CFA francs or 5% of pre-tax annual turnover, capped at 500,000,000 CFA francs; criminal sanctions (imprisonment and higher fines) apply to the most serious offences.

    artci.ci dataguidance.com

Timeline of decisions

  1. Guidance
    9th RAPDP Conference in Abidjan Adopts 2026–2030 Abidjan Declaration on Data Governance

    African data protection authorities from 24 countries convened in Abidjan for the 9th RAPDP conference hosted by ARTCI, adopting a 2026–2030 continental roadmap targeting AI, digital platforms, and biometric data. The Declaration frames personal data protection as a pillar of state sovereignty and economic attractiveness across Africa.

    Financial Afrik

  2. Guidance · official
    Decree mandates national registry of Data Protection Officers

    A decree of 16 August 2024 required all data controllers to designate and formally register a Data Protection Officer in ARTCI's national DPO registry, operationalising the accountability provisions of the 2013 personal-data protection law. ARTCI launched a compliance seminar in April 2026 in Yamoussoukro to help operators align with both this decree and Law No. 2024-352.

    ARTCI

  3. Law · official
    Law No. 2024-352 on Electronic Communications Enacted

    A comprehensive 252-article electronic communications law restructured ARTCI's oversight of operators, embedding explicit data-related obligations for telecoms providers and strengthening consumer protections for digital services. It replaces the prior sector framework and operationalises data protection within the communications regulatory regime.

    ARTCI

  4. Enforcement · official
    ARTCI Issues Formal Enforcement Notices Against Predatory Mobile Lending Apps

    After 10 named mobile lending applications failed to respond to ARTCI's August 2023 compliance ultimatum, ARTCI published a second communiqué exposing the apps by name and confirming formal mise en demeure notices — the most significant public enforcement action taken under Law No. 2013-450 to date, targeting systematic data misuse for blackmail and extortion.

    ARTCI

  5. Guidance · official
    ARTCI Public Warning on Personal Data Abuse by Online Lending Applications

    ARTCI issued a public communiqué alerting citizens to serious data protection violations by mobile lending apps — including harvesting contacts and photos for blackmail — and gave operators 10 days to comply with Law No. 2013-450; the first major regulatory alert specifically enforcing the 2013 data protection statute.

    ARTCI

  6. Law
    AU Malabo Convention on Cybersecurity and Personal Data Protection Enters into Force

    The African Union's Malabo Convention entered into force 30 days after Mauritania became the 15th ratifying state, with Côte d'Ivoire among the ratifiers; the Convention creates binding continental standards on data protection and cybercrime that legally supplement Côte d'Ivoire's domestic Law No. 2013-450.

    Data Protection Africa

  7. Law
    Côte d'Ivoire Cabinet Approves Ratification of the AU Malabo Convention

    The Ivorian Council of Ministers adopted the bill authorising ratification of the 2014 African Union Convention on Cyber Security and Personal Data Protection; the instrument was formally deposited with the AU in April 2023, making Côte d'Ivoire one of the 15 states that triggered the Convention's entry into force.

    KOACI

  8. Law
    New Constitution of Côte d'Ivoire Adopted — Privacy Right Constitutionalised

    Adopted by referendum on 30 October 2016, the new Ivorian Constitution enshrines the right to privacy, including protection of personal data, under Article 8, providing explicit constitutional foundation for data protection legislation and entrenching it against ordinary legislative repeal.

    Constitute Project

  9. Law · official
    Personal Data Protection Law No. 2013-450 enacted; ARTCI designated data-protection authority

    Côte d'Ivoire's foundational data law established individual rights — including an explicit right not to be subject to decisions based solely on automated processing — and required prior ARTCI notification for all personal data processing, with mandatory authorisation for sensitive data. The law directly governs AI systems that profile, score, or automatically decide on individuals, and remains the principal data-law basis for AI regulation.

    ARTCI (Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire)

  10. Law · official
    Law No. 2013-450 on Personal Data Protection — Côte d'Ivoire's Founding Data Protection Statute

    Côte d'Ivoire's primary data protection law, implementing the ECOWAS 2010 Supplementary Act, establishes consent-based processing rules, data subject rights (access, rectification, erasure, objection), mandatory prior declaration or authorisation with ARTCI, restrictions on sensitive data and cross-border transfers, and criminal penalties — designating ARTCI as the independent supervisory authority and making Côte d'Ivoire among the earliest West African states with a comprehensive data protection law.

    ARTCI

  11. Law
    ECOWAS Supplementary Act A/SA.1/01/10 on Personal Data Protection Adopted

    All 15 ECOWAS member states — including Côte d'Ivoire — became bound by this regional framework requiring national data protection laws and independent supervisory authorities built on the principles of legality, purpose limitation, proportionality, and data subject rights; it directly triggered Côte d'Ivoire's subsequent enactment of Law No. 2013-450.

    GhaLII / ECOWAS

Sources

  1. artci.ci/images/stories/pdf-english/lois_english/loi_2013_450_english.pdf
  2. artci.ci/images/stories/pdf/lois/loi_2013_450.pdf
  3. autoritedeprotection.ci/
  4. artci.ci/index.php/secteurs-regules/protection-des-donnees.html
  5. natlex.ilo.org/dyn/natlex2/r/natlex/fe/details?p3_isn=104182
  6. unodc.org/cld/document/civ/2013/loi_n_2013-450_relative_a_la_protection_des_don
  7. dataprotection.africa/wp-content/uploads/2020/03/Ivory-Coast-Factsheet-updated-20200331.pdf
  8. dataguidance.com/notes/ivory-coast-data-protection-overview
  9. africanlegalfactory.com/2024/01/30/understanding-personal-data-protection-in-cote-divoire/?la
  10. autoritedeprotection.ci/correspondants-a-la-protection/

Next for Côte d'Ivoire: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026