Senegal Public Administration and Generative AI: Protecting Government Data

In a ministry in Dakar, a head of division has to prepare a summary note on a recruitment file for the next morning. She has dozens of pages full of names in front of her. She opens an AI assistant on her phone, pastes everything in and gets a clean summary within seconds. The job is done, but personal information about candidates has just left for servers located outside Senegal.

This scene is becoming common in public offices. It raises a simple question: how can civil servants use generative AI without working against the digital sovereignty goals the State has set for itself?

The New Deal Technologique puts data at the center

Launched on 24 February 2025 in Diamniadio by President Bassirou Diomaye Faye, the New Deal Technologique sets the course for Senegal's digital sector until 2034, with an estimated cost of 1,105 billion CFA francs. It rests on four pillars: digital sovereignty, the digitalization of public services, the growth of the digital economy and positioning Senegal among Africa's digital leaders.

Several goals concern the administration directly:

• A national cloud, controlled by the State, to process sensitive data without relying on foreign technology.

• A single window, so that public offices stop asking citizens again for documents they have already provided.

• 90% of administrative procedures online by 2034.

• The use of AI to automate repetitive tasks and support decisions.

The country also has a national artificial intelligence strategy for 2023 to 2028, which makes public administration a priority sector.

Sovereign hosting is already in place

The national data center in Diamniadio, inaugurated in June 2021, hosts State data and applications. It is operated by Sénégal Numérique SA (SENUM SA), which succeeded ADIE.

This is where the spontaneous use of consumer AI tools creates tension. A civil servant who pastes a file into an online assistant sends that information to foreign infrastructure over which the administration has no control. The whole effort to host data at home can be bypassed with a simple copy and paste.

Law 2008-12 also applies to public services

Law No. 2008-12 on the protection of personal data makes no exception for the administration. Ministries, agencies and local authorities are data controllers like any other, supervised by the Commission de protection des Données Personnelles (CDP). They must respect the principles of purpose limitation and security, as well as the rules on transfers outside the country.

Public data is among the most sensitive there is: civil registry, tax, health, social benefits, land records and civil servants' careers. For the details of these obligations, read our guide to Law 2008-12 and generative AI.

What civil servants actually send to AI

These uses usually answer a real workload. Some of them still expose a lot:

• summarizing a citizen's file that includes their identity, address or family situation;

• rewording a reply to a complaint, with the name and the case number;

• analyzing a spreadsheet of payments, grants or social benefits;

• preparing a note about staff members, their appraisals or disciplinary measures;

• asking for help to fix a query on a government database.

Each of these actions can amount to processing without the required formalities and to an uncontrolled transfer. We explain the mechanism step by step in Anatomy of an AI data leak.

Ban or frame?

Some administrations choose to block AI websites on their network. Staff then switch to their personal phones, and management loses all visibility. Letting things happen without rules, on the other hand, means accepting that public data leaves the country without a trace.

A middle path is to allow AI for tasks that do not involve sensitive data, and to protect personal information automatically when it shows up in a prompt. The sovereignty issues at stake are close to those faced by security leaders in Europe, as we show in Sovereign AI: what CISOs need to know.

A roadmap for public bodies

1. Take stock of the AI tools used by each department, including on mobile phones.

2. Classify the information that must never go to an outside tool: civil registry, tax and social data, health data, staff files, unpublished documents.

3. Write a short internal memo that everyone can understand, listing the permitted uses.

4. Involve the CDP and the data lead of each body to check the formalities.

5. Favor solutions hosted in Senegal where they exist, working with SENUM SA.

6. Protect data at the source and keep a record of every incident avoided.

For a regional view of these questions, see also our article on generative AI and data protection in West Africa.

How ZeusLock helps

ZeusLock runs on civil servants' computers and browsers. It spots sensitive data in real time in the prompts and files sent to ChatGPT, Copilot, Gemini or Claude. Depending on the rules set by the administration, it anonymizes that data while keeping its format, shows a warning or blocks the upload. Citizens' real information stays within the State's perimeter. Every event is logged, which gives you concrete evidence for an inspection or an audit.

In short

With the New Deal Technologique, Senegal wants digital public services and data kept under national control. The spontaneous use of consumer AI by civil servants can weaken that goal. Law 2008-12 and the CDP set the framework. It is now up to public bodies to give their staff clear rules and tools that protect data without slowing down the work.

Do you run a public service or an agency in Senegal? Request a ZeusLock demo and see how your staff can use AI safely.