Niger

Art. 37 makes processing legitimate on the data subject's prior consent or the listed alternative grounds; Art. 68 requires information to the data subject no later than collection; Arts. 69-76 give rights of access, rectification, objection, erasure (answered within one month, Art. 73), restriction and portability. Art. 29 requires a prior formality with the HAPDP and Art. 79 a data protection correspondent for private-law controllers.

Art. 83 requires the controller to notify the HAPDP as a priority and without delay after becoming aware of a breach, justifying any delay, and to inform data subjects as soon as possible where the breach is likely to create a high risk. Art. 86 requires processors to notify the controller as soon as possible and within 72 hours.

Art. 9 requires prior approval before providing payment services and Art. 19 says the BCEAO grants it. Art. 48 requires customer funds to be identified separately and, if still held at the end of the next business day, placed in safeguarding accounts at banks or microfinance institutions, reconciled daily.

Art. 28(1) requires prior notice to the BCEAO and the Commission Bancaire at least 30 days in advance of outsourcing a critical operational function; Arts. 36-37 set outsourcing conditions and required contract content.

Art. 84 requires major operational incidents to be notified without delay, with a detailed incident report within 72 hours. Art. 83 requires internal and external intrusion tests at least once a year, with the reports sent to the Commission Bancaire and the BCEAO within 30 days of the test date.