Data protection & privacy law in Madagascar (2026)

Legal framework

Law No. 2014-038 of 9 January 2015 on the Protection of Personal Data, supervised by the Commission Malagasy de l'Informatique et des Libertés (CMIL), with Decree No. 2023-1541 of 6 December 2023 setting out CMIL's attributions, organisation and functioning

Key points: data & privacy in Madagascar

1. 01Primary law

   Law No. 2014-038 was adopted by the National Assembly on 16 December 2014, promulgated by the President on 9 January 2015 and published in the Official Gazette in mid-2015. It sets principles of lawfulness, purpose limitation, proportionality, data quality, security and confidentiality for processing personal data in Madagascar.

   digital.gov.mg afapdp.org ilo.org

2. 02Supervisory authority (CMIL)

   The Commission Malagasy de l'Informatique et des Libertés (CMIL) is the independent administrative authority responsible for enforcement. Its organisation and functioning were defined by Decree No. 2023-1541 of 6 December 2023, and following the swearing-in of its members in 2025 the CMIL has now begun operations, accompanying public-service dematerialisation projects and auditing electoral files.

   prea.gov.mg sysinfo.mef.gov.mg digital.gov.mg dlapiperdataprotection.com

3. 03Legal bases & consent

   Processing of personal data must rest on the data subject's prior consent or, alternatively, on compliance with a legal obligation of the controller, performance of a public-interest mission, performance of a contract, protection of a vital interest, or the legitimate interests of the controller balanced against the rights of the data subject.

   clym.io dataprotection.africa

4. 04Data subject rights

   Data subjects enjoy rights of information, access, rectification, erasure and objection regarding their personal data, and the law prohibits decisions that significantly affect a person from being based solely on automated processing intended to profile or evaluate aspects of their personality.

   digital.gov.mg afapdp.org

5. 05Cross-border transfers

   Transfers of personal data outside Madagascar are conditional on the recipient country ensuring an adequate level of protection; where adequacy is not established, transfers require additional safeguards, the data subject's explicit consent or CMIL authorisation, and onward transfers by the recipient also require the original controller's and CMIL's authorisation.

   clym.io dataprotection.africa

6. 06Sanctions & international recognition

   The law provides for administrative and criminal sanctions for breaches of its obligations, with fines and, for serious violations, prison terms. In November 2025 CMIL became the 28th full member of the Association francophone des autorités de protection des données personnelles (AFAPDP), formally embedding Madagascar in the francophone DPA network.

   francophonie.org newsmada.com afapdp.org

Timeline of decisions

1. 3 Dec 2025Guidance · official
   CMIL Publishes Official Procedures Manual

   The Commission Malagasy de l'Informatique et des Libertés (CMIL) published its full procedures manual on 3 December 2025, governing all organs, agents, and enforcement activities of the data-protection authority. This document operationalises complaint handling, audits, and sanctions under Law No. 2014-038.

   Unité de Gouvernance Digitale (digital.gov.mg)

2. 1 Nov 2025Decision · official
   CMIL Admitted as 28th Full Member of AFAPDP

   Madagascar's CMIL was accepted as the 28th full member of the Association francophone des autorités de protection des données personnelles (AFAPDP) in November 2025. Membership integrates CMIL into the global Francophone data-protection network and unlocks peer-support and capacity-building resources.

   AFAPDP

3. 1 Aug 2025Decision · official
   CMIL Members Sworn In — Data Protection Authority Declared Operational

   CMIL commissioners took the oath of office before Madagascar's Supreme Court in August 2025, making the supervisory authority functional more than a decade after the underlying statute was enacted. CMIL announced readiness to enforce Law No. 2014-038 and oversee data flows in telecom, banking, and the national e-identity programme.

   PREA (prea.gov.mg)

4. 1 Feb 2025Guidance · official
   AFAPDP Expert Mission Supports CMIL Operationalisation

   AFAPDP dispatched an expert mission to Antananarivo in February 2025, in cooperation with the Organisation Internationale de la Francophonie (OIF), to deliver recommendations on CMIL's governance, staffing, and enforcement procedures. The mission directly informed the authority's inaugural composition and its August 2025 swearing-in.

   AFAPDP

5. 21 Jun 2024Law · official
   Parliament Enacts Law No. 2024-004 Ratifying the AU Malabo Convention

   Madagascar's Senate and National Assembly adopted Law No. 2024-004 on 21 June 2024, ratifying the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention, 2014). The move aligns Madagascar with the continent-wide standard on data protection, e-transactions, and cybercrime, which entered into force globally in June 2023.

   African Union

6. 6 Dec 2023Law · official
   Decree No. 2023-1541 Establishes CMIL's Structure and Mandate

   Government Decree No. 2023-1541 of 6 December 2023 formally defined the attributions, organisation, and functioning of CMIL — the supervisory body provided for by Law No. 2014-038 since 2015 but never activated. The decree ended a nine-year enforcement vacuum and set the stage for appointing and swearing in commissioners.

   Ministère de l'Économie et des Finances (mef.gov.mg)

7. 20 Jul 2015Law · official
   Law No. 2014-038 Enters Into Force via Official Gazette

   Publication in Madagascar's Official Gazette on 20 July 2015 completed the entry into force of Law No. 2014-038. Despite the law being on the books, no implementing decrees were issued and CMIL was not yet constituted, leaving enforcement unapplied for nearly a decade.

   Unité de Gouvernance Digitale (digital.gov.mg)

8. 9 Jan 2015Law · official
   President Promulgates Law No. 2014-038 on Protection of Personal Data

   Adopted by the National Assembly on 16 December 2014 and promulgated on 9 January 2015, Law No. 2014-038 became Madagascar's first comprehensive data-protection statute. Modelled on the EU Data Protection Directive 95/46/EC and shaped with AFAPDP guidance, it covers consent, purpose limitation, data-subject rights, and security obligations for all automated processing on Malagasy territory.

   AFAPDP / Journal Officiel de Madagascar

9. 11 Dec 2010Law · official
   2010 Constitution Enshrines Right to Privacy

   Madagascar's Fourth Republic Constitution, promulgated on 11 December 2010, guarantees the inviolability of the person, the home, and the secrecy of correspondence. These provisions form the constitutional bedrock on which all subsequent data-protection and privacy legislation rests.

   Constitute Project / Madagascar Official Constitution

Sources

1. 1.digital.gov.mg/en/2022/07/05/loi-n-2014-038-sur-la-protection-des-donnees-a-caracter
2. 2.afapdp.org/wp-content/uploads/2015/01/Madagascar-L-2014-038-du-09-01-15-sur-la-p
3. 3.ilo.org/dyn/natlex/natlex4.detail?p_lang=fr&p_isn=99469&p_country=MDG&p_count
4. 4.sysinfo.mef.gov.mg/ROHI/assetsmart/legal/D2023-1541.pdf
5. 5.digital.gov.mg/wp-content/uploads/2025/12/manuel-procedures-cmil-03-dec-2025.pdf
6. 6.prea.gov.mg/reci/premiere-reunion-du-comite-doperationnalisation-de-la-cmil/
7. 7.francophonie.org/renforcement-gouvernance-numerique-madagascar-vers-une-protection-eff
8. 8.newsmada.com/2026/01/30/protection-des-donnees-digitalisees-la-commission-malagasy
9. 9.dlapiperdataprotection.com/index.html?t=authority&c=MG
10. 10.dataprotection.africa/madagascar/
11. 11.clym.io/regulations/law-no-2014-038-on-the-protection-of-personal-data-madaga