Skip to content
World Watch

Data protection & privacy law in Mali (2026)

Data protection in Mali: comprehensive law.

Mali enacted a comprehensive personal data protection law in 2013, establishing individual rights and controller obligations broadly analogous to pre-GDPR European frameworks. The independent supervisory authority APDP became operational in March 2016 and remains active as of 2026, having opened its first 2026 ordinary session in February with over 500 dossiers under review. A supplementary cybercrime law (Law No. 2019-056) adds further provisions relevant to digital data.

Last verified Official sources first · MethodologyCompare Mali with other countries

Legal framework

Law No. 2013-015 of 21 May 2013 on the Protection of Personal Data (as amended by Law No. 2017-070 of 18 December 2017), supervised by the Autorité de Protection des Données à caractère Personnel (APDP)

Key points: data & privacy in Mali

  1. Primary Legislation

    Law No. 2013-015 of 21 May 2013 on the Protection of Personal Data in the Republic of Mali is the omnibus data protection statute, covering collection, processing, storage, and transfer of personal data by both public and private actors.

    amrtp.ml cyrilla.org

  2. Supervisory Authority (APDP)

    The Autorité de Protection des Données à caractère Personnel (APDP) was created by the 2013 law and officially launched in March 2016. Its mandate includes registering processing activities, investigating complaints, issuing enforcement actions, advising government on data-related legislation, and promoting digital citizenship. In early 2026 it reviewed 500+ pending dossiers in its first ordinary session.

    apdp.ml rapdp.org malijet.com

  3. Controller Obligations

    Data controllers must notify the APDP of the purposes of processing before collection (public-sector entities may substitute a formal agreement with the authority). Controllers must implement appropriate technical and organisational security measures and ensure data is not damaged, distorted, or unlawfully accessed by third parties.

    dataprotection.africa caseguard.com

  4. Data Subject Rights

    Individuals hold rights to: be informed of collection and processing purposes; access their personal data; obtain rectification or erasure (false, inaccurate, or outdated data must be deleted within 30 days of request); and object to processing on legitimate grounds unless processing is based on a legal obligation.

    dataguidance.com dataprotection.africa

  5. Cross-Border Data Transfers

    Transfers of personal data to third countries are permitted only where the destination country provides an adequate level of legal protection for privacy, freedoms, and fundamental rights of individuals in relation to personal data processing, mirroring the adequacy-decision model.

    caseguard.com dataprotection.africa

  6. Amendments and Supplementary Laws

    Law No. 2017-070 of 18 December 2017 amended the 2013 law specifically regarding the functioning and organisation of the APDP. Law No. 2019-056 of 5 December 2019 on the Repression of Cybercrime contains additional provisions relevant to personal data protection in digital contexts.

    dataguidance.com iclg.com

Sources

  1. apdp.ml/
  2. amrtp.ml/en/download/law-no-2013-015-of-may-21-2013-on-the-protection-of-perso
  3. cyrilla.org/en/entity/nh5ellvo4ke
  4. rapdp.org/en/node/44
  5. dataprotection.africa/mali/
  6. dataprotection.africa/wp-content/uploads/2020/03/Mali-Factsheet-updated-20200331.pdf
  7. dataguidance.com/notes/mali-data-protection-overview
  8. caseguard.com/articles/a-new-legal-basis-for-data-processing-in-mali/
  9. malijet.com/a_la_une_du_mali/307823-protection-des-donnees--l%E2%80%99apdp-ouvre-
  10. iclg.com/practice-areas/data-protection-laws-and-regulations/mali

Next for Mali: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026