Guinea

Loi L/2016/037/AN relative à la cybersécurité et la protection des données à caractère personnel IN FORCE

commenced 2016 (promulgation) · Official full text ↗

Scope

Combined cybersecurity and personal data protection framework for Guinea.

Key obligations

Data protection principles; Formalities before the (never-established) DPA

DPO required

No.

Registration

Provided for; authority never constituted.

Cross-border transfers

Transfers to a 'pays tiers' - defined as any non-ECOWAS state (art. 1) - only where that state ensures a SUPERIOR OR EQUIVALENT level of protection, with prior authorisation of the DP Authority before any effective transfer and strict regular control (art. 28); the Authority authorises cross-border transfers under conditions set by Presidential decree. No transfer derogations exist in the text; intra-ECOWAS transfers fall outside the regime. (Verified from the archived scan via Vision OCR 2026-07-11, S27.)

Breach notification

Not operational.

Penalties

Criminal sanctions per the law.

Authority

DPA provided for but never established; ARPT/ANSSI hold fragments of the mandate

Verified 2026-07-06

Organic Law L/2010/004/CNT on the Right of Access to Public Information IN FORCE