Mali Law 2013-015: APDP and Data Sovereignty in the Age of AI

In Bamako, in a services company, a firm or a government department, AI assistants are now just a click away. People use them to write a letter, summarize a report, translate a document or prepare a presentation. The tool is free, fast and available on any phone.

What is less visible is where the data goes. Text pasted into ChatGPT or Gemini does not stay in Mali: it is processed on servers abroad, under the provider's rules. For a Malian organization, this is a compliance issue, but also a question of sovereignty over its own information.

The legal framework: Law No. 2013-015

In Mali, personal data protection is based on Law No. 2013-015 of 21 May 2013, amended by Law No. 2017-070 of 18 December 2017, which clarified in particular how the supervisory authority works. The text applies to any person, company or public body that processes information that can identify a person.

The law created the Autorité de Protection des Données à caractère Personnel (APDP), an independent administrative authority. The APDP receives declarations, issues opinions, inspects organizations and can impose sanctions.

An authority active in the field

The APDP does more than publish recommendations. In 2025, it fined a Bamako clinic 5 million CFA francs for obstructing an inspection related to undeclared video surveillance. More than a hundred companies also received formal notices for non compliance.

In October 2025, the authority opened an extraordinary session to review around 2,000 declaration files. The commissioners check legal compliance, information system security, retention periods and respect for individuals' rights. The law also provides for a fine of 5 to 20 million CFA francs for obstructing the authority's work.

The message is simple: formalities and inspections are real, including for the newest digital uses.

Data that leaves the country

Malian law strictly regulates transfers. A data controller may only transfer personal data to another country if that country provides a sufficient level of protection for people's privacy and freedoms.

Yet most consumer generative AI services host and process data outside Africa. When an employee pastes a customer file, a staff list or an administrative case into an online assistant, they are in fact making an international transfer. Without rules or controls, the organization no longer knows where its data is or who can access it.

Public administrations: extra caution needed

The public sector is directly concerned. The law requires processing carried out on behalf of the State to receive a prior reasoned opinion from the APDP. A public service that lets its staff freely use external AI tools on citizens' files therefore faces a double risk: a leak of sensitive information and processing that was never submitted to the authority.

The most common cases are very concrete:

• an official who has a civil registry or land file summarized;

• an HR team that rewrites named performance reviews;

• a finance department that analyzes payment spreadsheets;

• an IT team that sends a database extract to fix an error.

AI is gaining ground in Mali

The country is paying close attention to artificial intelligence. Mali has a Centre for Artificial Intelligence and Robotics, and the Council of Ministers of 23 April 2026 announced an annual national forum dedicated to AI, with conferences, prototype exhibitions and robotics competitions.

This momentum is positive. It also makes a practical question more urgent: how can organizations benefit from these tools without unknowingly exporting the data of customers, employees or citizens? Sovereignty issues go well beyond the continent, as we explain in Sovereign AI: what CISOs need to know.

Keeping control of your data

For a Malian company or public body, a sensible approach fits in a few steps:

1. Take stock of the AI tools in use, official or not.

2. Classify the information that must never leave: identity, health data, financial data, administrative files, trade secrets.

3. Check your formalities with the APDP, including the new uses.

4. Protect data at the source, before it leaves the workstation.

5. Document every prevented incident so you can answer an inspection.

To understand how a leak actually happens, read Anatomy of an AI data leak. For implementation, our 90-day rollout playbook covers each step. For a regional view, see our article on generative AI in West Africa.

The role of ZeusLock

ZeusLock works directly on devices and browsers. Before a prompt or file goes to ChatGPT, Copilot, Gemini or Claude, it spots sensitive data. Depending on the rules you set, it anonymizes it while keeping its format, warns the user or blocks the upload. The real information stays inside your organization, and every event is logged for your audits and your dealings with the APDP.

Summary

In Mali, Law 2013-015 and the APDP set a clear framework: formalities, a prior opinion for public sector processing, and transfers limited to countries with sufficient protection. Generative AI falls within this framework. Keeping control of your data means both complying with the law and protecting your digital sovereignty.

Want to see how to protect your data without slowing your teams down? Book a ZeusLock demo.