CBAO Groupe Attijariwafa Bank

Formal notice (mise en demeure), lifted after correction of the breaches within the deadline. CDP, December 2017. month-precision date

Record ID: sn-cdp-2017-0002
Jurisdiction: Senegal
Regulator: CDP
Type: enforcement notice
Date decided: December 2017
Respondent type: private
Sector: banking
Violations: retention period for certain data not explicit, unauthorised access to data, use of four PCs running Windows XP
Provisions cited: Loi n°2008-12 du 25 janvier 2008
Outcome: formal notice (mise en demeure), lifted after correction of the breaches within the deadline
Status: final
Source: Official document ↗
Record verified: 17 July 2026

Summary

The sanction committee of Senegal's CDP plenary session issued a formal notice (mise en demeure) against CBAO Groupe Attijariwafa Bank over an unclear data-retention period, unauthorised access to data, and the continued use of four computers running the obsolete Windows XP operating system. The notice was lifted after the bank corrected the breaches within the deadline, with the CDP directing continued strict observance of its information-security policy. Reported in Avis Trimestriel N°04-2017; the decision date is recorded at quarter-end precision.

BANKING · SECURITY · FORMAL NOTICE · LIFTED

Cite this decision

CDP (Senegal), CBAO Groupe Attijariwafa Bank, enforcement notice of December 2017. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/senegal/cdp/2017/cbao-attijariwafa-formal-notice-lifted/ (accessed 22 July 2026).

Track Senegal enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.