Chad's Law No. 007/PR/2015 on the Protection of Personal Data, enacted on 10 February 2015, establishes a comprehensive legal fraework for the collection, processing, storage, and dissemination of personal data within the country.

📜 Key Provisions of Law No. 007/PR/2015

1. Definitions

Personal Data:Any information relating to an identified or identifiable natural person, directly or indirectly, by reference to an identification number or to one or more elements specific to their physical, physiological, genetic, psychological, cultural, social, or economic identity

Data Controller:Any individual or entity that determines the purposes and means of processing personal data

Data Processor:Any individual or entity that processes personal data on behalf of the data controller

2. Principles of Data Processing The law mandates that personal data must be

Processed lawfully, fairly, and transparently.

Collected for specified, legitimate purposes and not further processed.

Adequate, relevant, and limited to what is necessary.

Accurate and kept up to date.

Kept in a form which permits identification of data subjects for no longer than necessary.

Processed in a manner that ensures appropriate security.

3. Rights of Data Subjects Individuals have the right to

Access their personal data.

Rectify inaccurate or incomplete data.

Erase data under certain conditions.

Object to processing based on legitimate interests.

Withdraw consent at any time, where consent is the legal basis for processing.

4. Data Breach NotificationData controllers must notify the Commission Nationale de la Protection des Données Personnelles (CNPD) within 72 hours of becoming aware of a data breachIf the breach poses a high risk to individuals' rights and freedoms, affected individuals must also be informed without undue delay

5. Penalties for Non-Compliance Violations of the law may result in

Administrative sanctions:Warnings, formal notices, or temporary/permanent prohibition of processing activities

Financial penalties:Fines ranging from XAF 1 million to XAF 10 million

Criminal liabilities:Imprisonment for up to one year

🏛️ Enforcement Authority

The Agence Nationale de Sécurité Informatique et de Certification Électronique (ANSICE), established by Law No. 006/PR/2015, serves as Chad's data protection authorit. ANSICE became fully operational in late 2020 and is responsible for overseeing compliance with data protection laws, including conducting investigations and imposing sanctions for violation.

✅ Summary

Chad's data protection law, Law No. 007/PR/2015, provides a robust framework for safeguarding personal data, aligning with international standard. Organizations operating in Chad or processing the personal data of individuals in Chad must ensure compliance with the law to protect individuals' privacy rights and avoid potential penaltie.