The verdict in three sentences
The customer data in your business software (identity, phone, addresses, purchases, sometimes ID documents) is a sensitive asset and a legal responsibility. In 2026, Senegal's law 2008-12, overseen by the CDP, and equivalent regimes across West Africa require encryption, access rights and logging. It is better to invest 20,000 to 80,000 FCFA/month in the right controls than to suffer a leak that destroys trust and exposes you to penalties.
Security controls by risk level
Not all controls are equal: prioritise by risk and effort. Encryption and access management are non-negotiable; the rest rolls out in tiers.
| Risk level | Priority control | Effort | Indicative 2026 cost |
|---|---|---|---|
| Critical | Encryption at rest + TLS | Medium | Included - 15,000 FCFA/month |
| Critical | Roles and access rights | Low | Included |
| High | Two-factor authentication | Low | 0 - 10,000 FCFA/month |
| High | Access logs | Medium | 5,000 - 20,000 FCFA/month |
| Medium | Export anonymisation | Medium | One-off |
| Medium | Processing register | Low | One-off |
| Low | Automatic retention purge | Low | Included |
The cost of a leak vs the cost of protection
A leak is not just a fine: there is the mandatory notification, lost customers, crisis-handling time and reputational damage. Here is the 2026 order of magnitude of an incident affecting a database of a few thousand customers.
| Item | Unmanaged leak | Well-protected database |
|---|---|---|
| Potential penalty | Variable, up to heavy | Sharply reduced |
| Customers lost | 5 - 20 % | Marginal |
| Crisis-handling time | 5 - 15 days | 0 - 2 days |
| Notification / audit cost | 200,000 - 1,000,000 FCFA | 0 FCFA |
| Monthly cost of controls | 0 FCFA | 20,000 - 80,000 FCFA |
| Customer trust | Lastingly damaged | Preserved |
Compliance: what the law actually expects
Compliance is not declared, it is documented. You need a processing register (which data, why, for how long), a legal basis for processing (consent, contract), respect for data subject rights (access, rectification, deletion) and a defined retention period with automatic purge. In Senegal, notifying the CDP may be required depending on the processing: we frame it from the software's design stage.
Mini case study
Ibrahim runs a dental practice in Dakar with patient-record software. Without access rights, the receptionist saw everything; a departing employee nearly exposed records. We segment: each profile sees only what it needs, with 2FA and access logs, for 30,000 FCFA/month. Cost of an avoided incident: impossible to price in terms of patient trust, but compliance protects his business and reputation for a marginal budget.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Does law 2008-12 apply to my small business?
Yes: as soon as you collect personal data (name, phone, purchases), you are a data controller. Size does not exempt you from securing and, depending on the case, notifying the CDP in Senegal.
Is encryption enough to be compliant?
No: encryption is necessary but not sufficient. You also need access rights, a processing register, a retention period and respect for data subject rights (access, deletion).
How much do the priority controls cost?
As a 2026 order of magnitude: 20,000 to 80,000 FCFA/month depending on sensitivity and volume. Encryption and roles are often included; logs and 2FA add a few thousand FCFA.
Who is liable in a leak, the agency or me?
The data controller is you as the operator. The agency is a technical processor; a good contract splits obligations, but usage compliance stays on your side.
Should I keep data indefinitely?
No, quite the opposite: keeping data too long raises the risk. We set a retention period per data type and enable an automatic purge once the deadline passes.
Let's talk about your project. We audit your business software's security and set up encryption, access rights and law 2008-12 compliance without weighing down your day-to-day. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
