Senegal Law 2008-12 and Generative AI: A Compliance Guide for Businesses

Since the launch of the New Deal Technologique in February 2025, Senegal has set a clear ambition: to become a leading digital hub in Africa. Inside companies, this ambition is already part of daily work. Teams use ChatGPT, Copilot or Gemini to write letters, analyze spreadsheets, prepare proposals or translate contracts.

This adoption is good news. But it raises a question many leaders have not settled yet: what happens to the personal data of your customers and employees when it is pasted into an AI assistant? In Senegal, the answer lies in one specific text, Law No. 2008-12 on the protection of personal data.

Law 2008-12 also applies to AI

The law does not mention artificial intelligence, since it dates from 2008. Yet it applies in full. As soon as a company based in Senegal processes information that can identify a person, it becomes a data controller. Copying a customer file into an AI tool is processing. Sending it to servers abroad is a transfer.

The Commission de protection des Données Personnelles (CDP) enforces this law. It receives complaints, regularly publishes opinions and can issue sanctions. This is not a theoretical issue.

Four obligations to keep in mind

1. A clear purpose

Data must be collected for a specific purpose and not reused for something else. A phone number collected to open an account is not meant to end up in a prompt to test a new tool.

2. Formalities with the CDP

Depending on their nature, processing operations must be declared to the CDP or authorized by it. Any AI use involving customer or employee data should be covered by these formalities, just like a new business application.

3. Security and confidentiality

The data controller must take the necessary measures to prevent data from being disclosed to unauthorized third parties. Letting every employee freely send sensitive data to an external service goes against this requirement.

4. Transfers outside Senegal

This is the most sensitive point. A transfer to a third country is only allowed if that country ensures an adequate level of protection, or under the conditions set by the CDP. Most consumer AI assistants process data outside the continent. Without safeguards, every prompt containing personal data can amount to an irregular transfer.

For an overview of the laws across the region, read Generative AI in West Africa: How to Protect Your Sensitive Data.

Five common situations in Senegalese companies

• Banking and microfinance: an advisor pastes a customer's history to draft a reply to a complaint.

• Telecoms and mobile money: an agent sends a transaction export to understand an anomaly.

• Insurance and healthcare: a claims handler summarizes a medical file with an AI assistant.

• Human resources: a recruiter compares full resumes that include ID numbers.

• SMEs and retail: a salesperson uploads an entire prospect list to generate personalized emails.

In each case, the intent is good and the time saved is real. The problem is the data that travels with the request. This phenomenon, often invisible to management, has a name: Shadow AI. We measured its impact in The Real Cost of Shadow AI in 2026.

Banning is not enough

Faced with the risk, some companies block AI websites on their network. The result is rarely what they expect. Employees switch to their personal phones and management loses all visibility. Training alone is not enough either: under the pressure of an urgent file, good intentions fade fast. We explain why in Why AI Security Training Doesn't Work.

The right approach is to let teams use AI while controlling what leaves the company.

A six step action plan

1. Map usage. Identify which AI tools are actually used and by which departments.

2. Classify data. List what must never go to an external AI: identity, banking data, health, employee data, technical secrets.

3. Update your CDP formalities. Include AI use in your declarations and your record of processing.

4. Write a simple policy. One page is enough, with concrete examples of what is allowed and what is not.

5. Protect at the source. Automatically detect and anonymize sensitive data before it reaches the AI. See our article on format-preserving anonymization.

6. Keep evidence. Log the incidents you prevented. During a CDP audit, it is your strongest argument.

For step by step implementation, follow our 90-day rollout playbook.

How ZeusLock helps Senegalese companies

ZeusLock runs on your teams' devices and browsers. It spots sensitive data in real time in prompts and files sent to AI assistants, including Senegalese phone numbers, ECOWAS ID card numbers and mobile money identifiers. Depending on your rules, it anonymizes, warns or blocks. Every event is logged to support your compliance.

Your employees keep their tools. You keep control of your data.

Key takeaways

Senegal is betting on digital and AI, and that is great news. Law 2008-12 does not prevent you from using these tools. It simply requires you to know which data leaves, where it goes and how it is protected. Companies that get organized now will gain an edge, with their customers and with the regulator.

Want to measure your company's exposure? Request a ZeusLock demo.