Data protection & privacy law in Guinea (2026)
Data protection in Guinea: comprehensive law.
Guinea enacted a standalone, comprehensive personal data protection statute in 2016 (Law L/2016/037/AN) covering lawful bases for processing, sensitive-data categories, data subject rights, and criminal penalties, broadly analogous in structure to GDPR. The dedicated supervisory authority (APDP) envisaged by the law has not yet been fully operationalised; the National Transition Council examined a draft law to formally create it in 2024. In April 2025, President Doumbouya signed a supplementary presidential decree reinforcing data-security obligations and introducing a national Personal Identification Number (NPI) system.
Legal framework
Law No. L/2016/037/AN on Cybersecurity and Protection of Personal Data (28 July 2016); ARPT (Autorité de Régulation des Postes et Télécommunications) as interim regulator; APDP (Autorité de Protection des Données Personnelles) under legislative creation
Key points: data & privacy in Guinea
Primary legislation
Law L/2016/037/AN of 28 July 2016 is a two-part statute: Part 1 covers cybercrimes; Part 2 establishes a comprehensive personal-data protection regime including definitions, lawful-processing grounds (consent, legal obligation, public interest, contract, vital interests), and data-controller obligations.
Supervisory authority
The 2016 law mandated creation of an independent data-protection authority. As of 2025 it remains unoperationalised; the ARPT currently exercises de-facto oversight, and the CNT (National Transition Council) examined a dedicated draft law in 2024 to formally establish the APDP as an independent administrative authority with legal personality and financial autonomy.
April 2025 presidential decree
On 14 April 2025, President Mamadi Doumbouya signed a decree defining conditions for collection, processing, conservation, and security of personal data nationally. It introduced an 18-character Personal Identification Number (NPI) assigned at birth, mandated secure double-entry authentication, and empowered the data authority to refer infringements to the prosecutor for immediate criminal sanctions.
Sensitive data & criminal penalties
The law defines a special category of sensitive data encompassing religious, political, trade-union, sexual, racial, health, and criminal-record information. Unlawful processing of sensitive personal data carries imprisonment of 1-7 years and fines of GNF 30,000,000-150,000,000.
Data subject rights
The 2016 law grants individuals rights of access, rectification, and opposition. A Data Protection Officer (DPO) obligation exists under Article 14 et seq., requiring a qualified person be designated by data controllers.
Constitutional basis
Article 12 of Guinea's Constitution enshrines the right to privacy, providing the constitutional grounding for the statutory data-protection framework. Cross-border data transfers are regulated under the 2016 law, restricting transfers to countries without adequate protection.
Sources
- arpt.gov.gn/loi-l2016-037-an-relative-a-la-cybersecurite-et-la-protection-des-don
- coursupreme.org.gn/en/loi-l-2016-037-an-relative-a-la-cybersecurite-et-la-protection-des
- cnt.gov.gn/personnel-apdp/
- focusguinee.info/2025/04/16/protection-des-donnees-personnelles-la-republique-de-guine
- afapdp.org/archives/2405
- dataprotection.africa/guinea/
- dlapiperdataprotection.com/index.html?t=law&c=GN
- afapdp.org/wp-content/uploads/2018/05/Guinee-loi_2016037an_relative_a_la_cyberse
- arpt.gov.gn/protection-des-donnees/
- guinee360.com/15/04/2025/guinee-gal-doumbouya-fixe-les-conditions-de-securite-et-de
Next for Guinea: Digital Payments & FintechPartial
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026