Establishing a New Standard for Data Privacy in Chad

Law No. 007/PR/2015 on the Protection of Personal Data is a data protection law that was passed in the country of Chad in 2015. Law No. 007/PR/2015 on the Protection of Personal Data was passed for the purposes of regulating the collection, processing, storage, transmission, and dissemination of personal data within the Republic of Chad. As such, the law places various responsibilities on data controllers and processors who operate within the country. Moreover, the law also establishes the punishments that data controllers and processors stand to face if they fail to comply with the law, or violate any of the rights that are afforded to data subjects under the law.

How are data controllers and processors defined under Law No. 007/PR/2015 on the Protection of Personal Data?

Law No. 007/PR/2015 on the Protection of Personal Data defines a data controller as “any individual or public/private company, any other agency or association which, alone or jointly with others, takes the decision to collect and process personal data and determines the purposes thereof”. Alternatively, the law defines a data processor as “any individual, public/private company, or any other agency or association which processes data on behalf of the data controller and under his instructions”. Furthermore, personal data is defined as “any information relating to a natural person, identified or identifiable directly or indirectly, by reference to an identification number or to one or more elements specific to his or her physical, physiological, genetic, psychological, cultural, social, and economic identity”.

What are the responsibilities of data controllers and processors under Law No. 007/PR/2015 on the Protection of Personal Data?

Law No. 007/PR/2015 on the Protection of Personal Data mandates that data controllers and processors who engage in data processing activities within the country of Chad follow a number of principles as it pertains to the collection and processing of personal data. These principles are as follows:

• The collection, processing, storage, recording, and transmission of personal data must be conducted in a manner that is lawful, fair, and non-fraudulent.
• Personal data may only be collected and processed for explicit, specific, and legitimate purposes.
• All personal data must be “relevant and not excessive in relation to the purposes for which they are collected and further processed”.
• All personal data must be “be kept for a period not exceeding the period necessary for the purposes for which they were collected/processed”.
• All personal data that is collected or processed must be accurate and updated whenever necessary.
• “The principle of transparency implies that the data controller must inform the data subject of any personal data processing operation that involves personal data”.
• All personal data that is collected or processed must be handled in accordance with the principles of confidentiality and protection.

What are the rights of data subjects under Law No. 007/PR/2015 on the Protection of Personal Data?

Law No. 007/PR/2015 on the Protection of Personal Data affords data subjects within the country of Chad with a variety of data protection rights. These rights include:

• The right to be informed- Data subjects have the right to inform data subjects of various details pertaining to the processing of their personal data, including the identity of the data processor and the categories of personal data concerned, among others.
• The right to access- Data subjects have the right to access various forms of information from a data processor, including a copy of their personal data, as well as information concerning the origin of said data.
• The right to rectification- Data subjects have the right to “require that the data controller rectifies their personal data if it is inaccurate, incomplete, unclear, or expired, or if the collection, usage, disclosure, or retention of the data is prohibited”.
• The right to erasure- Data subjects have the right to “require that the data controller deletes their personal data if it is inaccurate, incomplete, unclear, or expired, or if the collection, usage, disclosure, or retention of the data is prohibited”.
• The right to object or opt-out- Data subjects have the right to object to or opt-out of the processing of personal data, albeit it is on legitimate grounds.

What are the penalties for violating Law No. 007/PR/2015 on the Protection of Personal Data?

Data controllers and processors who violate the provisions set forth by Law No. 007/PR/2015 on the Protection of Personal Data are subject to two kinds of sanctions, administrative penalties imposed by the Agence Nationale de Sécurité Informatique et de Certification Électronique or the ANSICE for short and criminal liabilities pronounced by a judge. To this end, data controllers and processors who fail to maintain compliance with Law No. 007/PR/2015 on the Protection of Personal Data are subject to the following penalties:

• A warning to the data controller who does not comply with the obligations arising from the Law.
• A formal notice to put an end to the breaches concerned within the time limit which it fixes.
• Temporary or permanent prohibition of processing contrary to the provisions of the Law.
• A monetary fine ranging from XAF 1 million ($1,734) to XAF 10 million ($17,345).
• A term of imprisonment ranging from three months to one year.

As data protection and personal privacy become more important issues throughout the continent of Africa, as evidenced by the passing of other data privacy laws in the region such as Togo’s Law No. 2019-014 Relating to the Protection of Personal Data and Zambia’s Data Protection Act No. 3 of 2021, Chad has also taken legislative measures to ensure the data protection of their citizens through the enactment of Law No. 007/PR/2015 on the Protection of Personal Data. Through the provisions of the law, data subjects within Chad have an avenue for recourse should their personal data be collected or processed in a manner that is not in accordance with legal standards.