CIL compliance: personal-data checklist for businesses in Burkina Faso

Who is covered by personal-data protection in Burkina Faso?

Burkina Faso has a personal-data protection law and an independent authority, the Commission de l'informatique et des libertés (CIL). As soon as an organisation collects, stores or uses information that can identify a person (name, phone number, national ID number, e-mail address, photo, payroll data, purchase history), it is processing personal data and falls within the scope of the law.

That includes SMEs, schools, clinics, NGOs, shops that keep a customer file and websites with a contact form. Company size does not create an exemption.

This article is a methodology guide, not legal advice. For your specific situation, consult the CIL or a legal adviser.

Step 1: map your processing activities

You cannot protect what you do not know. Start with a record of processing activities that lists, for each use of data:

• the purpose (payroll, prospecting, pupil management, CCTV, etc.);
• the categories of people and data involved;
• internal and external recipients;
• the retention period;
• where the data is hosted (local server, cloud, foreign provider);
• the security measures in place.

A spreadsheet is enough to begin. What matters is that the record reflects reality, including Excel files on individual laptops and work WhatsApp groups.

Step 2: check the legal basis and purpose

Each processing activity needs a legitimate basis: performance of a contract, legal obligation, legitimate interest or consent. Consent must be free, informed and provable; a pre-ticked box or implied consent is not enough. Data must stay proportionate to the purpose: a newsletter sign-up form does not need a date of birth.

Sensitive data (health, ethnic origin, religious or political opinions, biometrics) enjoys reinforced protection and calls for particular care.

Step 3: complete the formalities with the CIL

Depending on the nature of the processing, the law provides for prior formalities: a declaration or an authorisation request to the CIL. Routine processing is generally declared; higher-risk processing (sensitive data, biometrics, transfers abroad, interconnection of files) may require authorisation. Check the forms and procedures published by the CIL to determine which regime applies to each of your processing activities, and keep the receipts.

Step 4: inform people and respect their rights

People must know who collects their data, why, for how long and how to exercise their rights. In practice:

• a readable privacy policy on your website and on paper forms;
• an information notice in employment contracts and enrolment forms;
• an internal procedure to answer access, rectification, objection and erasure requests within a reasonable time;
• an identified point of contact (dedicated e-mail address, named person).

Step 5: secure the data

The law requires appropriate technical and organisational measures. A minimum checklist for an SME:

1. Named accounts and strong passwords, ideally with two-factor authentication.
2. Access limited to what each role needs (sales staff cannot see payroll).
3. Disk encryption on laptops and backups.
4. Regular, tested backups, with one copy off site.
5. Security updates applied to servers and workstations.
6. Website served over HTTPS with forms protected against spam and injection.
7. A written data-breach procedure (who to notify, within what time, how to document).
8. Staff awareness of phishing and good practice.

Step 6: govern processors and transfers

Hosting provider, payroll software vendor, web agency, SMS provider: all of them handle your data. A contract or written clause must set out instructions, confidentiality, security and what happens to the data at the end of the service. Where data is hosted outside Burkina Faso, check the transfer conditions set by the law and the associated formalities with the CIL.

How do you stay compliant over time?

Compliance is not a file you close. Update the record with each new project (new software, new campaign, new camera), review retention periods once a year and purge data that is no longer needed. Appointing an internal lead, even part-time, makes the difference.

Digital Station helps businesses and institutions in Burkina Faso map their processing, secure their systems and prepare their compliance files. Let's talk about your situation.