The verdict in three sentences
A Dakar subsidiary of a European group must comply with two regimes at once: Senegal's Law 2008-12 on personal data, enforced by the Commission de Protection des Données Personnelles (CDP), and the GDPR that head office applies to its processing. The website compliance budget in 2026 sits between 500,000 and 1,500,000 FCFA (760 to 2,290 EUR) for the audit and 300,000 to 800,000 FCFA (460 to 1,220 EUR) for reworking forms and cookies, over 4 to 8 weeks. The common mistake is copying the group's GDPR policy without a prior filing with the CDP, even though that filing is what makes processing lawful in Senegal.
What Law 2008-12 actually requires for a website
Law 2008-12 requires every processing of personal data to be declared to the CDP, or to receive prior authorisation for sensitive processing: health data, biometrics, file interconnection, and transfers to a third country lacking adequate protection. For a subsidiary whose website sends form data to a CRM hosted in Europe or the United States, the transfer question arises with the very first sales enquiry.
| Requirement | Law 2008-12 (CDP) | GDPR (head office) | Website impact |
|---|---|---|---|
| Prior formality | Declaration or authorisation with the CDP | No filing, internal record | CDP file to submit before forms go live |
| Transparency | Mandatory at collection | Mandatory (Art. 13) | Notices under each form, in French |
| Transfers outside Senegal | Regulated, CDP authorisation depending on country | Standard contractual clauses outside the EU | CRM and hosting location to document |
| Cookies and trackers | Information and consent expected | Strict prior consent | Single banner set to the stricter standard |
| Data subject rights | Access, rectification, objection | Access, erasure, portability, objection | Request form and response deadline |
| Penalties | Fines up to 100 million FCFA, plus criminal penalties | Up to 4 % of global turnover | Dual exposure for subsidiary and group |
A reform of the law has been discussed in Senegal for several years. In 2026, Law 2008-12 remains the applicable text, and the CDP regularly publishes decisions and sanctions.
The detailed budget and timeline
The amounts below are 2026 ballparks observed in Dakar for a 15 to 40 page corporate site with 3 to 6 forms. They include technical and documentation work, excluding lawyer fees for litigation.
| Item | Cost (2026 ballpark) | EUR equivalent | Timeline |
|---|---|---|---|
| Compliance audit of the site and data flows | 500,000 to 1,500,000 FCFA | 760 to 2,290 EUR | 1 to 2 weeks |
| Reworking forms and cookie banner | 300,000 to 800,000 FCFA | 460 to 1,220 EUR | 1 to 3 weeks |
| Preparing the CDP declaration or authorisation file | 150,000 to 400,000 FCFA | 230 to 610 EUR | 1 week of preparation |
| CDP review | No agency fee | No agency fee | Variable, from a few weeks to several months for an authorisation |
| Privacy policy aligned with Law 2008-12 and GDPR | 150,000 to 350,000 FCFA | 230 to 530 EUR | 3 to 5 days |
| Kolonell maintenance with compliance monitoring (Standard plan) | 75,000 FCFA / month | 110 EUR / month | Ongoing |
The realistic timeline is 4 to 8 weeks for the site and filing work, with CDP review time added if an authorisation is required. Plan to run the affected forms in minimal mode (contact without transfer) during the review.
Fitting local compliance with head office GDPR
The most effective method is to apply the stricter rule of the two regimes on each technical point, then add Senegal-specific formalities. In practice: a GDPR-standard cookie banner, notices drafted to cover both texts, a shared record of processing kept by the group DPO with a subsidiary section, and a dedicated CDP file describing transfers to head office tools. The local IT director owns the relationship with the CDP, while the group DPO validates consistency.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mr Fall, IT director of the 60-employee Dakar subsidiary of a European logistics group (illustrative persona), must bring a 25-page site with 4 forms connected to head office's CRM into compliance. Budget chosen: audit 900,000 FCFA, forms and banner rework 550,000 FCFA, CDP file 250,000 FCFA, i.e. 1,700,000 FCFA (about 2,590 EUR). Head office had received a 6,000 EUR quote (about 3,936,000 FCFA) from a European firm that did not cover the CDP filing. Savings: 2,236,000 FCFA, with the local formality handled on top.
FAQ
Must a subsidiary website be declared to the CDP?
Yes, as soon as it collects personal data through forms, a client area or trackers. Sensitive processing or transfers to certain third countries require prior authorisation rather than a simple declaration.
Is group GDPR compliance enough in Senegal?
No, the GDPR does not replace Law 2008-12 for processing carried out in Senegal. It covers most technical requirements, but not the prior filing with the CDP.
How much does a compliance audit cost in Dakar?
Expect 500,000 to 1,500,000 FCFA (760 to 2,290 EUR) as a 2026 ballpark for a 15 to 40 page site. The price depends on the number of forms, connected tools and cross-border flows.
How long does compliance take?
The technical and documentation work takes 4 to 8 weeks. CDP review of an authorisation request can add several weeks, sometimes several months.
What does a non-compliant subsidiary risk?
The CDP can issue warnings, formal notices and fines of up to 100 million FCFA, on top of the criminal penalties set by the law. For the group, local non-compliance can also undermine its own GDPR commitments.
Let's scope your project. Describe your site, your forms and the head office tools they connect to: we price the audit, the rework and the CDP filing, with an indicative budget and a 4 to 8 week timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
