The verdict in three sentences
In Senegal, data protection rests on Law 2008-12 and oversight by the CDP (personal data protection commission): declaration of processing, consent, security and sometimes prior authorisation. Bringing a company in Dakar or Abidjan into compliance costs between 1,000,000 and 6,000,000 FCFA in 2026 depending on size and processing. As soon as data flows to the EU (clients, partners, European hosting), the local law must be aligned with the GDPR, or the flows will be blocked.
Local obligations
The first step is knowing what the company is subject to. Many overlook the CDP declaration, which is nonetheless mandatory.
| Obligation | Status | Detail |
|---|---|---|
| Declaration of processing to the CDP | Mandatory | Prior formality |
| Prior authorisation (sensitive data) | Depends on processing | Health, biometrics |
| Obtaining consent | Mandatory | Clear purpose |
| Security measures | Mandatory | Encryption, access |
| Informing individuals | Mandatory | Notices, rights |
| Appointing a contact | Recommended | Point of contact |
| Framing transfers | Mandatory | Flows outside Senegal |
Compliance cost in FCFA
As in Europe, breaking it into batches lets you phase the effort. Here are 2026 orders of magnitude for a company in Dakar.
| Batch | Content | 2026 cost (FCFA) |
|---|---|---|
| Audit + mapping | Inventory of processing | 500,000 - 1,200,000 |
| CDP declarations | Files and formalities | 300,000 - 800,000 |
| Legal texts | Policy, notices, consent | 400,000 - 1,000,000 |
| Technical hardening | Encryption, access, backup | 500,000 - 2,000,000 |
| Support / contact person | Annual retainer | 800,000 - 2,500,000/year |
Local, regional or European hosting
Hosting choice balances latency, sovereignty and cost. A site mainly targets the local market; a SaaS app may target international users.
| Option | Dakar latency | Sovereignty | 2026 cost (FCFA/month) |
|---|---|---|---|
| Local/regional host | Low (fast) | Data in Senegal | 15,000 - 150,000 |
| Regional African datacenter | Low to medium | ECOWAS/WAEMU zone | 30,000 - 250,000 |
| European host (OVH, Scaleway) | Medium (~50-100 ms) | EU, easier GDPR | 10,000 - 200,000 |
| Hyperscaler (AWS/Azure) | Variable | US (Cloud Act) | Variable, pricey egress |
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Local hosting optimises latency for Senegalese users and eases compliance with Law 2008-12; EU hosting simplifies flows to European partners under GDPR.
Mini case study
Me Diop, partner at a consulting firm in Dakar, handles sensitive client data and works with partners in France. Without compliance, he risks blocked EU flows and a CDP challenge. He commissions compliance in three batches: audit (900,000 FCFA), CDP declarations + texts (1,100,000 FCFA), hardening (1,500,000 FCFA), i.e. 3,500,000 FCFA. He chooses certified European hosting at 120,000 FCFA/month to smooth exchanges with his GDPR partners. Result: the EU flows are unblocked, a European contract worth 20,000,000 FCFA requiring compliance can be signed, and the CDP fine risk is removed.
FAQ
Is Law 2008-12 really enforced? Yes, the CDP audits and can impose sanctions. Beyond legal risk, compliance is increasingly demanded by European partners and large accounts, making it a commercial argument as much as an obligation.
Do you have to host in Senegal? Not systematically, but some data and sectors require localisation or strict transfer controls. Local hosting reduces latency and simplifies compliance with Law 2008-12.
How do you handle data flows to the EU? You must frame the transfer (contractual clauses, adequate safeguards) and respect both the local law and the GDPR. EU hosting and suitable contracts smooth these exchanges with European partners.
How long does compliance take? Allow 4 to 10 weeks depending on size and the number of processing activities. CDP declarations and technical hardening are often the longest steps.
Is a data protection contact mandatory? Appointing one is strongly recommended and becoming a standard. External support (800,000 - 2,500,000 FCFA/year) is enough for most SMEs to maintain compliance over time.
Let's scope your project. Describe your business (sector, data types, flows to the EU) and we'll frame Law 2008-12/CDP compliance with suitable hosting. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
