Mali

Summary

Mali presents moderate risk on paper; enforcement is nascent and disrupted by political instability. Law No. 2013-015 of 21 May 2013 on personal data protection established the APDP (Autorité de Protection des Données Personnelles) and applies to collection of personal data including from publicly available sources; the APDP was amended in 2017 and issued an enforcement warning in 2024 against unauthorised collection and sharing of personal data (penalties CFA 5–20 million). The Constitution of 23 July 2023 (transitional military government) explicitly recognises the right to personal data protection. Law No. 2019-056 of 5 December 2019 on the suppression of cybercrime criminalises unauthorised access to computer systems and data interference; a specialised national cybercrime unit (pôle national) exists in Bamako. Law No. 2024-027 of 13 December 2024 is the new Mali Penal Code — it is a general criminal law reform, not a DP-specific instrument, but may incorporate or modify data-related offence provisions; its interaction with Law 2019-056 and Law 2013-015 has not been fully analysed. No EU-style sui generis database right; database protection is compilation-originality only. Mali is an ECOWAS member. Two military coups (2020, 2021) and ongoing instability have severely constrained regulatory and judicial function. No web-scraping case law.