CBAO Groupe Attijariwafa Bank

Formal notice (mise en demeure), lifted after correction of the breaches within the deadline. CDP, December 2017.

Record ID: sn-cdp-2017-0002
Jurisdiction: Senegal
Regulator: CDP
Type: enforcement notice
Date decided: December 2017
Respondent type: private
Sector: banking
Violations: retention period for certain data not explicit, unauthorised access to data, use of four PCs running Windows XP
Provisions cited: Loi n°2008-12 du 25 janvier 2008
Outcome: formal notice (mise en demeure), lifted after correction of the breaches within the deadline
Status: final
Source: Official document ↗
Source integrity: SHA-256 795f1767f5ad1a83…
Record verified: 30 July 2026

The facts

The CDP's 2017 avis records a formal notice against CBAO Groupe Attijariwafa Bank for retention periods that were not made explicit, unauthorised access to data, and the use of four workstations running an obsolete operating system.

Orders and outcome

The formal notice (mise en demeure) was lifted after the bank corrected the failings within the deadlines set.

BANKING · SECURITY · FORMAL NOTICE · LIFTED

Cite this decision

CDP (Senegal), CBAO Groupe Attijariwafa Bank, enforcement notice of December 2017. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/senegal/cdp/2017/cbao-attijariwafa-formal-notice-lifted/ (accessed 30 August 2026).

Track Senegal enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.