Ivory Coast (UEMOA Bloc) Data Protection & Privacy Regulation

Controller/Processor Duties

Controllers and processors operating under Loi n°2013-450 in Cote d'Ivoire are understood to be subject to a mandatory annual security report obligation, a recurring compliance duty that sits alongside the law's general security-measures requirements for the protection of personal data. This obligation forms part of the standing compliance burden that organisations processing personal data in Cote d'Ivoire should expect to maintain on an ongoing basis, separate from any one-off registration or authorisation steps required at the point a processing activity begins.

A distinct and so far unresolved question concerns whether Ivorian law imposes a specific statutory obligation on controllers to notify ARTCI, or affected data subjects, following a personal-data breach. No primary source was identified either confirming the existence of such a breach-notification duty or establishing its absence. This should be treated as a genuine gap in the current record rather than evidence either way: organisations should not assume the absence of a confirmed notification duty means no such obligation exists, nor should they assume one is confirmed where it has not been verified. This gap is particularly salient because breach-notification obligations are frequently the single most operationally significant controller duty in comparable data-protection regimes elsewhere, shaping incident-response timelines and regulator-engagement protocols; its unresolved status in Cote d'Ivoire's framework leaves a material open question in the controller-duties landscape.

Separately, controllers operating in Cote d'Ivoire have, since the second half of 2026, had access to ARTCI's CERTINUM platform, launched on 2 July 2026, which allows compliance and processing-authorisation requests to be submitted online rather than through the prior paper-based channel. This is understood as a procedural and administrative development affecting how controller obligations are discharged in practice, rather than a change to the substance of what is required under the 2013 law itself. The platform's existence suggests ARTCI is actively investing in making the filing and authorisation-request channel more accessible, which may over time affect how readily controllers fulfil formal filing duties, though no information indicates whether online filing has yet shifted actual compliance rates.

Outlook

The breach-notification question remains the most significant open item within this module and is the one most likely to be resolved by a future primary-source finding, whether through an ARTCI guidance document, an amendment to the 2013 law, or a sectoral instrument addressing incident reporting specifically. Until such a source is located, controllers operating in Cote d'Ivoire should treat their notification posture as an area of genuine legal uncertainty rather than a settled compliance position. The CERTINUM platform's continued operation and any future enhancements are also worth monitoring, as an authority investing in digital filing infrastructure may in parallel be building the administrative capacity needed to formalise or clarify duties, such as breach notification, that currently sit unresolved.

Cross-Border & Adequacy

Cote d'Ivoire's cross-border data-transfer regime under Loi n°2013-450 requires prior authorisation from ARTCI, together with an adequacy or equivalence guarantee regarding the destination's data-protection standards, for any transfer of personal data outside the country. Transfers within the Economic Community of West African States are exempt from this requirement, reflecting the regional economic-integration logic that treats intra-ECOWAS data flows differently from flows to third countries generally. ARTCI is reported to have exercised this authorisation power in practice, having granted named transfer authorisations to Portugal, Tunisia and the United States in June 2025, which indicates the mechanism is functioning operationally for at least some non-exempt destinations rather than existing only on paper.

The most significant open question in this area follows from a regional development external to Cote d'Ivoire's own data-protection law: the formal withdrawal of Burkina Faso, Mali and Niger from ECOWAS, effective 29 January 2025. Because the ECOWAS exemption from transfer-authorisation requirements is defined by reference to ECOWAS membership, the withdrawal of these three states raises a direct question of whether data transfers from Cote d'Ivoire to Burkina Faso, Mali or Niger now fall outside the exemption and so require the same prior ARTCI authorisation and adequacy guarantee that apply to transfers to any other non-exempt third country. No primary source addressing this question, whether from ARTCI, CENTIF, or a regional ECOWAS instrument, was identified. This is a genuinely open point in the framework rather than a settled position in either direction, and it has practical significance for any organisation that routes personal data between Cote d'Ivoire and these three states as part of ordinary business operations in the sub-region.

Taken together, the transfer-authorisation mechanism itself appears administratively functional, evidenced by the 2025 authorisations already granted, while the scope of its principal exemption has become uncertain as a direct consequence of regional political developments that sit outside the data-protection framework itself. This is a structural rather than incidental uncertainty: it does not stem from any ambiguity in the 2013 law's drafting, but from a subsequent geopolitical fact, the ECOWAS withdrawal, that the law's exemption clause did not anticipate.

Outlook

Resolution of the ECOWAS-withdrawal question would most plausibly come either from an ARTCI clarification confirming how it is treating transfers to Burkina Faso, Mali and Niger in practice, or from a broader regional instrument addressing the data-protection consequences of the three states' withdrawal. Organisations with data flows touching those three states should treat the authorisation requirement as an open risk pending such clarification, rather than assuming the ECOWAS exemption continues to apply by default. No indication suggests when such clarification might emerge.

Enforcement & Redress

Cote d'Ivoire's statutory penalty framework under Loi n°2013-450, Article 51(4), is severe on its face. Repeated pecuniary breaches of the law's requirements are capped at 5 percent of the responsible entity's prior-year net turnover excluding tax, up to an absolute ceiling of FCFA 500,000,000. Separately, unauthorised processing of sensitive personal data is treated as a criminal offence, carrying a prison term of ten to twenty years alongside a fine of FCFA 20 to 40 million. On paper, this places Cote d'Ivoire's data-protection penalty regime among the more severe statutory frameworks in the region, combining a turnover-linked civil ceiling with custodial criminal exposure for the most sensitive category of processing.

Against that statutory backdrop, the practical enforcement record shows a marked gap. As at July 2026, ten years after the law's adoption, ARTCI had not pronounced a single pecuniary sanction, notwithstanding having received 210 complaints and having conducted 18 compliance-control inspections over the decade. This is a significant and well-evidenced finding: a regulator with substantial statutory powers, an active complaints channel generating a three-figure caseload, and a demonstrated inspection capacity through 18 completed controls, has nonetheless not exercised its pecuniary sanctioning power even once in ten years of operation. This should be read as a material implementation gap between the law's formal severity and its practical application, a gap that matters directly to any realistic assessment of compliance risk in the jurisdiction: the statutory ceiling describes maximum theoretical exposure, while the decade-long enforcement record describes the probability that exposure has, to date, actually materialised in a pecuniary sanction.

This enforcement gap should not be read as an absence of regulatory activity altogether. The volume of complaints received, 210, and inspections conducted, 18, indicates that ARTCI has been actively engaging with its oversight mandate through non-pecuniary channels, such as investigation and compliance control, even where that engagement has not culminated in a formal monetary sanction. It is possible that ARTCI's approach to date has favoured informal resolution, warnings, or compliance-improvement measures over formal pecuniary sanctions, though no information confirms what, if any, non-pecuniary enforcement outcomes have resulted from the 210 complaints and 18 inspections. The launch of ARTCI's CERTINUM online filing platform on 2 July 2026 is a separate but related development, representing an investment in administrative infrastructure for compliance and authorisation filings that may, over time, affect the regulator's overall enforcement posture, though it does not itself constitute an enforcement action.

Outlook

The zero-pecuniary-sanction record is the single most significant redress-and-enforcement finding for Cote d'Ivoire, and it is the item most worth monitoring going forward: any first pecuniary sanction issued by ARTCI would represent a material shift in the jurisdiction's practical enforcement posture and would be a strong signal that the statutory penalty ceilings in Article 51(4) are not merely theoretical. No information indicates whether or when such a first sanction might be issued, and the CERTINUM platform's administrative build-out, while notable, should not be read as a direct precursor to enforcement activity absent further evidence.

Enforcement & Redress

As at July 2026, a decade after the data-protection law's adoption, the regulator had issued no pecuniary sanction, despite having received 210 complaints and carried out 18 compliance controls over that period. This is a finding about enforcement practice, not about the regulator's legal powers, which are substantial: the statute caps a repeated pecuniary breach at five percent of the offending entity's prior-year turnover excluding tax, subject to an overall ceiling of FCFA 500,000,000, and treats unauthorised processing of sensitive personal data as a criminal offence carrying ten to twenty years' imprisonment together with a fine of FCFA 20 to 40 million.

The combination describes a regime with real statutory teeth sitting alongside an enforcement record that has not, to date, used them in pecuniary form. Complaints-handling and inspection activity have continued at a measurable pace, so the gap is specifically in the step from investigation to public sanction, not in the regulator's intake or inspection function.

Outlook

The newly centralised digital filing record gives the regulator a clearer picture of controller engagement than it has had before, and that visibility is the kind of precondition that often precedes a first sanctioning action after a long quiet enforcement period. Whether the ten-year run without a pecuniary fine continues, or breaks, is the central question for this area into the next reporting period.

Enforcement & Redress

ARTCI's published decision log evidences a continuing case-by-case practice of prior authorisation for cross-border data transfers, illustrated by Decision n°2025-1264 of 19 June 2025, which authorised a transfer to the United States by Advans Cote d'Ivoire for its use of Amazon Web Services. This is a primary-source record drawn directly from ARTCI's own published decisions, and it demonstrates an active, functioning authorisation process rather than a dormant statutory power. Combined with the CERTINUM platform's July 2026 launch for dematerialised handling of authorisation and declaration requests, the available evidence points to ARTCI operating a working administrative and enforcement infrastructure, even where certain specific statutory duties, such as whether a formal breach-notification obligation exists under Loi n°2013-450, remain unconfirmed at the pinpoint-article level in evidence reviewed.

The RAPDP conference and the CERTINUM launch are, together, the two material developments falling within the current lookback window for this module; no enforcement action, fine, or sanction against a specific controller was identified beyond the routine authorisation-decision activity described above.

Outlook

Whether ARTCI continues to publish cross-border transfer decisions with the same transparency evidenced in the Advans Cote d'Ivoire matter, and whether the statutory basis for a breach-notification duty is clarified one way or the other, are the two items most worth tracking.

Enforcement & Redress

ARTCI's statutory powers are reported to include receiving and processing data-processing declarations, investigating complaints relating to data breaches, conducting investigations and inspections, and imposing sanctions ranging from a formal notice through fines to suspension of activity. Against that reported power set, a July 2026 report states that ARTCI has not pronounced any monetary sanction in the ten years since Loi n°2013-450's adoption, despite having received 210 complaints and conducted 18 inspections over that period. This is a material finding about the regime's practical character: a decade of complaint-handling and inspection activity has not, on the evidence located this cycle, produced a single monetary penalty. ARTCI's most recent enforcement-adjacent action is procedural rather than punitive — the launch of CERTINUM on 2 July 2026 and the follow-up communiqué of 3 August 2026 urging its use by controllers, correspondents and advisory firms, both of which point toward a regulator whose current emphasis is on compliance facilitation rather than sanction.

Outlook

Whether the decade-long absence of monetary sanctions persists, or whether CERTINUM's rollout is eventually paired with a more active enforcement posture, is the central question for this module going forward. No sanction, suspension or formal-notice action was reported in the period under review, so the zero-monetary-sanction record remains the defining enforcement fact for the jurisdiction as it stands.

Enforcement & Redress

ARTCI's online filing channel has been operationalised through the Certinum portal, reported as reachable at certinumapdp.ci. The portal is understood to now allow regulated entities to submit processing-authorisation requests, request conformity certificates, and file CCTV authorisations with ARTCI online, rather than through the manual or paper-based channels previously in use. This is reported to operationalise existing declaration and authorisation duties that already exist under Loi n°2013-450 and its implementing instruments, rather than to introduce a new substantive obligation. No specific enforcement decision, sanction, or fine dated within the period reviewed was located, and no fine-tier figures for data-protection breaches under the statute have been confirmed from primary ARTCI material.

The practical effect of the Certinum portal, if it functions as reported, is to lower the administrative friction of complying with ARTCI's existing declaration and authorisation requirements, which could in turn support more consistent filing behaviour among controllers and processors operating in Côte d'Ivoire. This is distinct from a change to ARTCI's underlying enforcement powers or sanction tiers, which remain as previously recorded and are not re-assessed here.

Outlook

Whether the Certinum portal's operationalisation translates into a measurable increase in declaration and authorisation filings, or into ARTCI enforcement activity grounded in better visibility over non-compliant controllers, is the item to watch going forward. The statutory breach-notification deadline, if any exists under Loi n°2013-450, and ARTCI's specific fine tiers for data-protection breaches, remain unconfirmed from primary text and are open items for future research.

Enforcement & Redress

Cote d'Ivoire's data-protection enforcement regime combines administrative and criminal mechanisms. Article 45 of Loi n°2013-450 punishes obstruction of the Autorite de Protection's investigative action with one month to two years' imprisonment and a fine of 1,000,000 to 10,000,000 CFA francs, giving ARTCI's investigative powers a criminal backstop rather than leaving compliance with an investigation purely voluntary.

On the administrative side, ARTCI issued Decision n°2024-0996 on 16 January 2024, a warning and formal notice against the Ministere de l'Enseignement Technique, de la Formation Professionnelle et de l'Apprentissage. This is notable both for its target -- a government ministry rather than a private-sector controller -- and for its form, a warning and formal notice rather than a monetary penalty, suggesting ARTCI's practice to date favours a graduated enforcement approach that begins with formal notice before escalating.

Taken together, the criminal-obstruction provision and the January 2024 ministry decision indicate a regulator with both the statutory teeth and the demonstrated willingness to act against non-compliant bodies across the public and private sectors, though the evidence base for enforcement volume beyond this single 2024 decision remains thin this cycle.

Outlook

Watch for whether ARTCI escalates beyond warnings and formal notices to monetary penalties in future decisions, and for whether enforcement activity against private-sector controllers, not evidenced this cycle, becomes visible in subsequent reporting.