Mauritania Law 2017-020: APD Rules and Generative AI Risks

In Nouakchott, companies often work in two languages. A contract arrives in Arabic, a technical note in French, a report has to be translated before the management meeting. Generative AI assistants make these tasks much faster, and many employees already use them every day.

The downside is well known: whatever is pasted into an AI tool goes to foreign servers. In Mauritania, these uses are governed by a specific law, Law No. 2017-020 on the protection of personal data, and by an authority that is becoming more and more visible.

Law No. 2017-020: what it covers

Adopted in 2017, Law No. 2017-020 sets the rules for any collection and use of information that can identify a person. It applies to private companies and public bodies alike. Among other things, it requires data to be processed for a specific purpose, protected against unauthorized access, and handled with respect for the rights of the people concerned.

The law also regulates transfers of data abroad, which are only allowed to countries offering an adequate level of protection. This is a key point for generative AI, since most consumer assistants process data outside the country.

An authority now at work

The law provided for an Autorité de Protection des Données à caractère Personnel (APD). It is now active. In January 2026, the APD, chaired by Mohamed Lemine Ould Sidi, signed a cooperation agreement in Marrakech with the CNDP, its Moroccan counterpart, after nearly two years of discussions.

The agreement covers compliance, oversight of data processing, complaint handling and building a data protection culture among public bodies and private players. For Mauritanian companies, the signal is clear: the 2017 law is no longer theoretical, and the authority is organizing itself to enforce it.

An ambitious digital strategy

The country has launched a deep digital transformation. The National Digital Transformation Agenda 2022-2025 set the direction, and the Ministry of Digital Transformation, Innovation and Modernization of Administration has drawn up a national artificial intelligence strategy for 2024-2029.

This strategy gives an explicit place to data governance and AI ethics, including compliance with data protection rules. It also targets sector uses in health, education, agriculture, fishing, transport and energy. In other words, the State encourages AI, but within a controlled framework.

Mining, banking, telecoms: exposed sectors

Three sectors deserve special attention, because they hold sensitive data and adopt digital tools quickly:

• Mining and energy: iron ore, gold and gas weigh heavily in the economy. Geological reports, production data, contracts with foreign partners and staff files are all strategic information that an engineer may be tempted to have summarized or translated by an AI.

• Banking and finance: account numbers, transaction histories and credit files are both personal data and information covered by banking confidentiality.

• Telecoms: operators manage subscriber files, location data and call records, some of the most sensitive data there is.

In these sectors, technical teams also use coding assistants and command line tools. These tools can carry away access keys or configuration files without anyone noticing, as we explain in CLI AI tools leak your secrets.

The concrete risks of AI at work

The most common incidents are anything but dramatic. An executive assistant has a contract translated that includes a partner's contact details. A customer adviser pastes a complaint with the customer's account number. An HR manager has a named performance review rewritten. Each time, the information leaves the company and the country.

The cost of these invisible leaks is rarely measured, even though it can be high. We put figures on it in The real cost of Shadow AI in 2026. Awareness alone quickly shows its limits, as our article Why AI security training doesn't work explains.

How to get organized

1. Identify real AI uses in each department, including on phones.

2. List the data that must never be shared: identity, banking data, subscriber data, production data, contracts, technical secrets.

3. Contact the APD to check the formalities that apply to your processing, especially transfers abroad.

4. Protect data automatically, before it is sent, rather than relying on everyone's memory.

5. Keep records to demonstrate your compliance.

For an overview of the neighboring legal frameworks, read our article on generative AI and data protection in West Africa.

What ZeusLock does

ZeusLock is installed on devices and browsers. It analyzes in real time the prompts and files sent to ChatGPT, Copilot, Gemini or Claude and spots sensitive data. Depending on your rules, it anonymizes the data while keeping its format, alerts the user or blocks the upload. Every event is logged for your audits.

Summary

In Mauritania, Law No. 2017-020 fully applies to generative AI, and the APD is building the means to enforce it. With a national AI strategy focused on data governance, the direction is set. Companies in mining, banking and telecoms have every reason to set rules for these tools now.

Want to see ZeusLock in action in your environment? Book a demo.