Port of Lomé and AI: Protecting Freight Forwarder Data in Togo

At the Autonomous Port of Lomé, ships berth day and night and trucks leave for Burkina Faso, Niger or Mali. Behind every container sits a stack of documents: bill of lading, commercial invoice, packing list, customs declaration, transit mandate. These papers pass through the hands of freight forwarders, customs brokers, shipping agents and hauliers.

Lately, they also pass through ChatGPT. A declarant asks AI to read a scanned invoice, a sales rep has it translate an exchange with a Chinese client, an assistant asks it to summarise a claims file. The time saved is real. But client and cargo data leave the company without anyone really deciding it should.

Lomé, a regional logistics platform

The Port of Lomé has become a transshipment hub in West Africa thanks to its deep-water berths, which can handle very large vessels. In late 2025, the Togolese press reported a rise in traffic driven by transshipment and by flows to the hinterland. The landlocked countries of the Sahel rely heavily on this corridor for their supplies.

Togo has also digitised much of the paperwork. The foreign trade single window, operated by SEGUCE Togo, has been running at the port since 2014 and was extended to land borders in 2015. Documents therefore already circulate in electronic form. That is a strength, but it also makes copying and pasting into an AI tool easier than ever.

What data sits in a transit file

A logistics file looks technical, but it holds plenty of sensitive information:

• names, phone numbers and addresses of importers, exporters and consignees;

• tax identification numbers and bank details;

• declared value of goods, purchase prices and margins;

• routes, transit dates and container numbers;

• copies of ID documents of drivers and representatives.

Some of this data is personal and falls under the law. Some is commercial: a competitor would pay a lot to know a major importer's prices and volumes. Either way, it does not belong in a consumer AI assistant.

What Togolese law says

Law No. 2019-014 on the protection of personal data applies to any information that identifies a person, including an SME manager or a truck driver. It requires prior declarations, respect for purpose limitation and data security. The Personal Data Protection Authority (IPDCP) started operating on 28 March 2025 and can impose fines of up to 100 million CFA francs.

We covered this framework in detail in our guide to Law 2019-014 and what the IPDCP expects. For a freight forwarder, the practical question is simple: when an employee pastes a client file into an AI tool hosted abroad, can the company justify that processing and that transfer? Most of the time, it cannot.

The most common leak scenarios

In forwarding and shipping agencies, risky situations look alike:

1. Reading scanned documents. Someone drops an invoice or a bill of lading into AI to extract the data. The whole file goes, with every name and amount.

2. Writing emails. Someone asks for a polite reply to a client upset about a delay, pasting the entire email thread.

3. Calculating and checking. Someone pastes a table of duties and taxes to check an assessment.

4. Translating. Someone translates a contract with an Asian or European supplier, pricing clauses included.

These actions slip past traditional security tools, which mainly watch email and the network. We explain why in why email DLP fails on ChatGPT.

Keep the AI, remove the data

Banning AI in a forwarding agency is not realistic. Teams work under pressure, with tight clearance deadlines and clients calling all day. The right approach is to let the tool work, but without the data that has no business being there.

In many agencies, documents are also photographed with a phone and then sent to AI to be read. Controls must therefore cover files and images, not just typed text.

In practice, before sending, client names, tax numbers, amounts and container numbers are replaced with fictitious values in the same format. The AI can still structure the invoice or draft the email, and the result remains usable. We describe this technique in format preserving anonymization.

An action plan for port businesses

Here is a realistic approach for a freight forwarder or customs broker in Lomé:

• take a quick inventory of the AI tools used in the agencies and at the port;

• classify documents by sensitivity: invoices, bills of lading, ID documents, contracts;

• declare the relevant processing operations to the IPDCP;

• equip workstations with a control that detects and anonymises data before it is sent;

• keep an incident log to answer clients, partners and the regulator.

Large shippers and international shipping lines ask more and more questions about the data security of their subcontractors. For a regional overview, read our article on AI and data protection in West Africa.

Summary

The Port of Lomé lives on the trust of its clients, from Sahel shippers to international carriers. Logistics documents contain personal and commercial data that should not end up in an AI assistant. Law 2019-014 and the IPDCP provide a clear framework, and anonymisation at the moment of sending keeps the benefits of AI without exposing client files.

ZeusLock detects sensitive data in prompts and files, anonymises it before sending and logs every incident. Book a ZeusLock demo to secure your transit files.