Health data sovereignty in Senegal: law 2008-12, CDP and hosting

Dr Moussa Ndiaye, a cardiologist in Plateau, is offered a free app to manage his agenda and consultation notes. He asks the salesperson one question: where will my patients' files be stored? The answer, "in the cloud", tells him nothing about which country, which law, or who can open them.

That question is what health data sovereignty is about. This article explains what Senegal's personal data law (law 2008-12) says about health data, what the CDP (the national data protection authority) does, what changed in 2026, where data can be hosted in Senegal, and how the continental framework fits in. It is general information, not legal advice.

Sovereignty is about control, not walls

Health data sovereignty means that patients' records stay under the control of Senegalese law and institutions: you know where they are stored, who can read them, which rules apply and who answers for a breach. Storing data inside the country (localisation) is one way to get there, not the whole answer.

It does not mean isolation. A record can be hosted in Dakar and still be shared, with the patient's consent, with a pharmacy in Medina or the national health information system. Sovereignty decides who holds the keys; standards such as FHIR (the international format for health data, explained in FHIR, simply) decide how the doors open.

What law 2008-12 says about health data

Senegal's reference text is law no. 2008-12 of 25 January 2008 on the protection of personal data. It defines data "in the field of health" as any information about a person's physical and mental state, including genetic data (article 4), and lists health among sensitive data. Processing sensitive data is prohibited in principle (article 40), with exceptions such as the person's written consent (article 41).

For health purposes, article 43 lists the cases where processing is legitimate. They include the patient's consent, public health, and preventive medicine, diagnosis and care, when the data is handled under the supervision of a health professional bound by professional secrecy.

Three other provisions matter for hosting:

• Scope. The law covers processing carried out on Senegalese territory, and processing by a controller (the organisation responsible for the processing) established abroad that uses processing means located in Senegal; that controller must appoint a representative in Senegal (article 2).
• Transfers abroad. Personal data may only be transferred to a country that ensures a sufficient level of protection of privacy, freedoms and fundamental rights, and the controller must inform the CDP before any transfer (article 49). Article 50 allows limited exceptions, for example a one-off, non-massive transfer to which the person has expressly consented.
• Security. Processing is confidential (article 70), and the controller must take every useful precaution to prevent, among other things, alteration of the data or access by unauthorised third parties (article 71).

The CDP: who checks, and how

The law creates the Commission de protection des données à caractère personnel, known as the CDP, an independent administrative authority (article 5). Most processing must be declared to it (article 18). Some needs its prior authorisation (article 20), including processing that concerns genetic data and health research, biometric data or a national identification number, and processing that interconnects files.

The CDP receives complaints, keeps a public register of processing and can impose sanctions (article 16). These range from a warning and a formal notice to a provisional withdrawal of authorisation and a fine of 1 to 100 million FCFA (articles 29 and 30).

The authority is active. In its report for the second quarter of 2026, the CDP processed 195 files, granted 39 of 41 authorisation requests, received 8 complaints and carried out 5 inspections. It refused one website, citing among other shortcomings an unspecified retention period and the absence of consent before a transfer to a third country. One of the projects it approved was medical research on HIV in children and adolescents.

Is there a newer law?

Not yet, as of 8 October 2026. Law 2008-12 is still the reference text. The CDP launched a revision in 2017, and a draft received a favourable opinion from the Supreme Court in 2022 but was still awaiting adoption by the government in October 2024. In June 2026, the reform was still described as long awaited, with the new text yet to be written.

A different law did move. On 20 August 2026, the National Assembly unanimously adopted, by 127 votes, bill no. 25/2026 on the protection of critical information infrastructure and digital security. According to the summary published by Vie-publique.sn, it sets the principle that the State's data must be kept on national territory, in State-owned public infrastructure or with approved private providers, with exceptions. The national cybersecurity authority is to set the standards for approving private cloud providers based in Senegal.

This is a cybersecurity law, not a replacement for law 2008-12. Its exact effect on private clinics and health platforms will depend on the final published text and its implementing decrees, which we will follow.

Where data can live in Senegal

Hosting in Senegal is now a practical option. Datacenter Map lists seven facilities in the Dakar area, including operator sites in Rufisque and Diamniadio. Three of them illustrate the range of options:

The Diamniadio centre was presented as a tool of digital sovereignty, and the national digital strategy launched in February 2025, the New Deal Technologique, makes digital sovereignty one of its four pillars. Availability and prices must be confirmed with each operator.

What "hosted in Senegal" really requires

A server in Dakar is a start. On a real health platform, patient data also travels through backups, technical logs, video calls, messaging and support tools. Before trusting the label, a clinic manager can ask:

1. Where are the main database and its backups?
2. Where do logs and monitoring data go? They often contain names and phone numbers.
3. Do video consultations pass through relay servers abroad?
4. Which providers send the SMS, WhatsApp messages or emails, and what data do they receive?
5. Who can log in to production systems, and from which country?
6. Who holds the encryption keys?
7. Has the processing been declared to the CDP, and has the CDP been informed of any transfer abroad?

Key idea "Hosted in Senegal" is a property of the whole chain, not of one server. If any link stores or sends personal data abroad, that is a transfer, and law 2008-12 sets conditions for it (article 49).

The continental picture

Senegal is part of a wider movement. The African Union Convention on Cyber Security and Personal Data Protection, known as the Malabo Convention, was adopted on 27 June 2014. It entered into force on 8 June 2023; Senegal ratified it in August 2016, and the AU status list counted 20 ratifications in February 2026.

In February 2022, the AU Executive Council endorsed the AU Data Policy Framework, which aims at harmonised data governance and the free and secure flow of data across the continent, while safeguarding rights. The message is consistent: each country protects its citizens' data under its own law, and countries agree on common rules so that data can move safely when it must.

For health, that means records hosted in each country and exchanged in a common format, with the patient's consent. Who sees what, and how each access is traced, is the subject of our article on patient consent and health records.

How Quralys approaches this

Quralys plans to host its production data in Senegal, with three candidates (the national data centre in Diamniadio, PAIX Dakar and Onix Dakar), and to declare its processing to the CDP under law 2008-12.

Because every record is stored in FHIR shape from the first day, moving into a Senegalese data centre is a migration of resources, not a redesign. The same common format is what will later let other countries in the region host their own data at home while speaking the same language. The roadmap is on our vision page.

Sources

1. Vie-publique.sn: Law no. 2008-12 on the protection of personal data (full text, PDF)
2. Dakaractu: CDP activity report for the second quarter of 2026
3. Le Tech Observateur: updating the personal data protection bill (October 2024)
4. Osiris: the CDP on video surveillance and biometric data (June 2026)
5. Vie-publique.sn: vote on bill no. 25/2026 on critical information infrastructure and digital security
6. Datacenter Map: data centres in Dakar
7. Africa Check: the New Deal Technologique in four points
8. DCD: PAIX Data Centres breaks ground on facility in Dakar
9. Onix Data Centres: Senegal
10. African Union: Convention on Cyber Security and Personal Data Protection
11. African Union: status list of the Malabo Convention (updated February 2026)
12. Power Law Africa: African Union publishes the AU Data Policy Framework