The verdict in three sentences
A site collecting data in Senegal falls under Law 2008-12 and must be registered with the CDP (Personal Data Protection Commission). If it also targets Europe, GDPR applies: explicit cookie consent, right of access and deletion. Compliance — legal notices, cookie banner, CDP registration — costs, as an order of magnitude, 100,000 to 400,000 FCFA and avoids far heavier penalties.
Two frameworks to know
Law No. 2008-12 on the protection of personal data governs, in Senegal, any collection: contact form, newsletter, customer account, tracking. It requires prior registration with the CDP and respect for principles (purpose, consent, security, limited duration). European GDPR adds on as soon as you target or process data of EU residents — common if you sell to the diaspora.
The two frameworks overlap widely: consent, transparency, individual rights, data security. Complying with one makes the other easier.
Obligations, responsible parties and penalties
| Obligation | Who is concerned | Penalty for breach |
|---|---|---|
| Registration with CDP | Any site collecting data | Fine, formal notice |
| Explicit cookie consent | Sites with tracking/analytics | CDP / GDPR penalty |
| Visible legal notices | All sites | Non-compliance, dispute |
| Privacy policy | All sites with a form | Penalty, loss of trust |
| Right of access and deletion | Any data controller | Complaint, penalty |
| Limited retention period | Any customer file | Penalty, audit |
| Data security (encryption) | Any controller | Liability in case of breach |
Compliance cost and timeline
| Item | Cost (order of magnitude) | Timeline |
|---|---|---|
| Legal notices + privacy policy | 50,000–120,000 FCFA | 2–4 days |
| Cookie consent banner | 40,000–100,000 FCFA | 1–3 days |
| CDP registration (assisted) | 50,000–150,000 FCFA | 2–6 weeks (processing) |
| Processing records | 30,000–80,000 FCFA | 2–5 days |
| Full compliance pack | 100,000–400,000 FCFA | 2–6 weeks |
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Official penalty amounts and timelines depend on the CDP; treat these figures as a 2026 estimate to confirm for your case.
Mini case study
Malick opens an e-commerce site in Dakar with a form, newsletter and Google Analytics. Without compliance, he risks a CDP formal notice and loss of customer trust. He chooses a 250,000 FCFA pack: legal notices, privacy policy, cookie banner with consent, and assistance with CDP registration. In 4 weeks, his site complies with both frameworks and can sell confidently to the European diaspora with no GDPR risk.
FAQ
Do I really have to register my site with the CDP? Yes. As soon as you collect personal data (even a simple contact form), Law 2008-12 requires registration with the CDP. It's a formality, not an option.
Does GDPR concern me if I'm in Senegal? Yes if you target or process data of EU residents — for example by selling to the diaspora. In that case, explicit consent and access/deletion rights apply.
Is a cookie banner enough? No. You need genuine consent (the user can refuse), a clear privacy policy, legal notices and a legal basis for each processing activity.
How long should I keep customer data? The principle is a duration limited to the purpose: for example a few years after the last purchase for a customer. You must document this duration in your records.
Let's talk about your project. We bring your site into compliance with Law 2008-12 and GDPR — notices, cookies, CDP registration — turnkey. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
