Benin Digital Code and AI: A Practical Checklist for Companies

Benin's public administration is going digital fast, and companies are following. In a bank in Cotonou, an insurance office in Parakou or a small business in Porto-Novo, employees already use ChatGPT, Copilot or Gemini to write, translate or analyze files. Often with no framework, and sometimes with customer data.

Yet the country has a precise legal text, the Digital Code, and an active regulator, the APDP. This article skips the theory. It offers a concrete checklist for a Beninese company that wants to use AI without falling foul of the law.

The framework in two minutes

Law No. 2017-20 on the Digital Code of the Republic of Benin, amended by Law No. 2020-35, devotes its Book V to the protection of personal data. The Personal Data Protection Authority (APDP), an independent administrative authority, oversees its application.

What this means for AI:

• Processing of personal data must be declared to the APDP or recorded in the register kept by the organization's data protection officer.

• Transfers to a country without an adequate level of protection require safeguards approved by the APDP.

• Data breaches must be reported to the APDP without delay.

• Fines can reach 50 million CFA francs, and 100 million for repeat offences.

A state that leads by example

Benin has made digital technology a pillar of public action. In 2022, the government merged several agencies into the Agency for Information Systems and Digital Affairs (ASIN). Many administrative procedures can now be completed online. In January 2023, the Council of Ministers adopted the National Strategy for Artificial Intelligence and Big Data (SNIAM) for 2023 to 2027.

The APDP, for its part, keeps running awareness sessions with players from health, finance, local government and other sectors. The message is simple: process data lawfully, ethically and securely. Companies that work with the state or provide services to it are the first concerned. For them, this means two things: their public counterparts expect secure digital exchanges, and their own teams are already used to working online. AI is landing on prepared ground.

The 10-point checklist

Here are the steps to follow, in order. Allow a few weeks for a small business and a quarter for a large organization.

1. List the AI tools in use. An anonymous questionnaire to your teams is enough. The answers may surprise you.

2. Identify the data at stake. Names, phone numbers, ID numbers, Mobile Money accounts, medical records, payslips.

3. Appoint a data protection officer. They keep the register of processing and become the APDP's point of contact.

4. Record AI uses in the register. Purpose, categories of data, recipients, country of storage.

5. Check transfers. Where are each tool's servers located? If outside Benin, what safeguards does the contract provide?

6. Choose business plans. Consumer versions of some assistants may reuse conversations. Enterprise plans usually offer clearer contractual commitments.

7. Write a one-page policy. With concrete examples: what can be pasted into an assistant, and what never is.

8. Anonymize before sending. Automatically replace sensitive data with dummy values in the same format.

9. Plan the breach procedure. Who alerts whom, how fast, and how the APDP is notified.

10. Keep evidence. Log the incidents you prevented and the measures you took. That is what an inspection will ask for.

Three common situations in Benin

The counter and customer service

An agent receives a complaint and pastes the customer's history into a chatbot to draft a polite reply. The phone number, the name and sometimes the ID number go along with it.

Healthcare

A medical secretary asks AI to summarize a report. Health data is sensitive data, subject to stricter rules under the Digital Code.

Human resources

A recruiter compares full resumes or has a dismissal letter rephrased. This is personal data, and the employer remains responsible for it.

These actions are routine, and that is exactly the problem. We explain why traditional tools miss them in why email DLP fails on ChatGPT.

Mistakes to avoid

• Blocking everything. Employees switch to their personal phones and you lose all visibility.

• Betting everything on training. Useful, but not enough under daily pressure. See why AI security training doesn't work.

• Thinking small size protects you. The Digital Code also applies to small businesses, and a leaked customer file damages trust whatever the size of the company.

• Forgetting the register. An undocumented AI use is hard to defend in front of the APDP.

For a detailed rollout schedule, follow our 90-day rollout playbook.

How ZeusLock helps you tick the boxes

ZeusLock is installed on your teams' devices and browsers. It detects sensitive data in real time in prompts and files sent to AI assistants, including Beninese phone numbers and Mobile Money identifiers. Depending on your rules, it anonymizes while preserving the format, warns or blocks. Points 8 and 10 of the checklist are covered, and point 1 becomes much easier thanks to visibility on Shadow AI.

Key takeaways

Benin has a clear framework, a regulator that makes itself heard and a state moving fast on digital. For companies, the right answer is not to ban AI but to govern it methodically: register, policy, anonymization and evidence.

Want to see what your teams are already sending to AI? Request a ZeusLock demo.