Personal data protection in Niger: the checklist

Niger's Law No. 2017-28 places concrete obligations on any organisation handling personal data — customers, patients, students, employees, project beneficiaries. Here is what an inspection checks, in the order it checks it.

1. Know what you process

The processing register is the first document requested. It fits in a spreadsheet and lists, for each file: purpose, categories of people, data collected, who has access, retention period and security measures. Without it, none of the following steps can be demonstrated.

Start from the real inventory, not the theoretical one: the customer spreadsheet on a sales rep's laptop, the WhatsApp group where phone numbers circulate, the visitors' book, the shared mailbox. Those are the problem, not the business software.

2. Register with the HAPDP

Registration is filed with the Haute Autorité de Protection des Données à caractère Personnel. Sensitive processing — health, biometrics, offences — requires prior authorisation, which is more demanding than a simple filing. Plan ahead.

3. Inform people

Every form, on paper or online, must say who collects the data, why, for how long, and how to exercise one's rights. Three lines under the form are enough, provided they are accurate.

4. Restrict access

Shared accounts are the most common weakness and the easiest to fix. One named account per person, rights matching the actual role, and access removed on the day someone leaves: three rules that resolve most observed incidents.

5. Secure it properly

• HTTPS on any site that collects anything.
• Encrypted backups, tested at least once — a backup never restored is not a backup.
• Two-factor authentication on administrative access.
• Logging of access to sensitive data.
• Deletion at the retention deadline: keeping data “just in case” is a breach.

6. Bind your processors

Hosting provider, development contractor, data collection firm: each must be covered by a contract stating what they may do with the data and what they must do with it when the assignment ends. A partner who refuses that commitment is a risk, not a saving.

Where to start tomorrow morning

If you do only one thing: open a spreadsheet, list your personal data files, and note who has access to each. Everything else follows from that inventory, and it rarely takes more than half a day.