Togo

Summary

Togo presents moderate risk on paper; enforcement has recently become active. Law No. 2018-026 of 7 December 2018 on cybersecurity and the fight against cybercrime criminalises fraudulent access to computer systems, aligned with the ECOWAS cybersecurity directive (C/DIR. 1/08/11) and Budapest Convention framework. The Cyber Defense Africa (cda.tg) site hosts an English translation of the law. Law No. 2019-014 of 29 October 2019 on personal data protection established the Instance de Protection des Données à Caractère Personnel (IPDCP). The IPDCP officially launched its activities on 28 March 2025 in Lomé and in July 2025 began the mandatory declaration process for video surveillance systems — enforcement is now active. Primary text of Law 2019-014 is available from the Togo Ministry of Digital Economy (numerique.gouv.tg). Togo ratified the AU Malabo Convention on 19 October 2021 (National Assembly authorised ratification 30 June 2021); Malabo is binding on Togo. No EU-style sui generis database right; database protection is compilation-originality only. Togo is an ECOWAS member. Confidence raised to medium: both laws are sourced, the IPDCP is operational, and the Malabo Convention binding position is confirmed. The prior note that Togo had "not ratified" Malabo was incorrect and is corrected here.