Senegal

Art. 33 makes consent the basis of lawful processing, with exceptions; Arts. 37 and 58-59 require information to data subjects; Arts. 62-67 give a right of access, Art. 68 a right of objection and Art. 69 rectification and deletion. Art. 49 requires an adequate level of protection and prior notice to the CDP for transfers abroad.

Arts. 39-41 require a continuity plan with a named owner and crisis committee, based on an impact analysis, and Art. 41 requires it to be tested at least once a year, with results documented and sent to the executive and governance bodies and to internal audit. Art. 31 requires a physical and logical security framework for information systems.

Art. 33 requires the governing body to approve outsourcing contracts, keeps data available within the UMOA (or on backup servers in the Union) and requires any draft outsourcing contract to be submitted beforehand to the Commission Bancaire's Secrétariat Général. Arts. 34-36 set contract content, provider due diligence updated at least annually and a continuity plan for outsourced activities.

Art. 28(1) requires notice at least 30 days before outsourcing a critical operational function; Art. 36 applies the requirement to outsourcing contracts for critical functions.

Art. 84 requires notice without delay of major operational incidents, including security breaches as defined in Art. 3(26), followed by a detailed report within 72 hours. Art. 82 requires incident management procedures and Art. 83 continuity plans for disruptions caused by tests or cyberattacks.