Personal Data Protection in Togo: 2026 Guide (Law 2019-014)

Since March 2025, Togo's data protection authority, the Instance de protection des données à caractère personnel (IPDCP), has been officially at work. It has launched the declaration of surveillance cameras, opened an online platform for those declarations in March 2026, started certifying data protection officers, and reminded businesses and public bodies of their obligations. The law it enforces, however, dates from October 2019: Law No. 2019-014 on the protection of personal data.

If your website has a contact form, if your app creates user accounts, or if you text your customers, you process personal data, and this law applies to you. Here is what it actually requires, seen by someone who builds these systems, with the articles to back it up.

This article is a technical reading of the law, up to date as of 12 October 2026. It is not legal advice: for a specific case, contact the IPDCP or a lawyer.

The essentials in 7 points

Almost every processing must be declared to the IPDCP before it starts; some (biometrics, health, national ID numbers) need an authorisation.
Consent is the rule: free, informed and explicit, except where the law provides otherwise (contract, legal obligation, public-interest task, protecting the person's interests).
Every form must inform people: who collects the data, what for, for how long, and with which rights.
Cookies and trackers must be explained, with a clear way to object to them.
Marketing by text message, WhatsApp or email requires prior consent.
Hosting or transferring data outside Togo requires an adequate level of protection and informing the IPDCP beforehand.
Penalties reach 100 million CFA francs in administrative fines, and up to five years in prison for criminal offences.

Does the law apply to your website or app?

Personal data is any information that identifies a person, directly or indirectly: a name, a phone number, an email address, a photo, a customer number (article 4). Processing covers everything you do with it: collecting, recording, consulting, sending, storing, deleting.

The law applies to businesses, associations, the State and local authorities (article 2). It also covers a controller established outside Togo as soon as it uses means of processing located in the country. Only strictly personal or household use falls outside it (article 3).

In practice, it covers:

a company website with a contact form;
an online shop and its customer database;
a mobile app with user accounts;
HR software, a time clock, a CRM;
a WhatsApp or SMS mailing list;
the surveillance cameras of a shop or an office.

Declaration, authorisation or opinion: which formality?

The law sets out three prior formalities. They come before the processing starts, not after.

Declaration, the general case

By default, every processing must be declared to the IPDCP (article 6). The authority issues a receipt within one month at most, which it can extend once. The key point: only receiving the receipt entitles you to start the processing, and it does not relieve you of any of your responsibilities.

The IPDCP can publish simplified standards that lighten or remove the declaration for common kinds of processing (article 7). Appointing a data protection officer also exempts you from declaring, unless you transfer data abroad (article 5).

Authorisation, for sensitive processing

You need the IPDCP's authorisation before processing (article 8):

biometric data, such as a fingerprint time clock or facial recognition;
genetic data or health research data;
data on offences, convictions or security measures;
a national identification number or any other general-purpose identifier;
data processed for a public-interest purpose, notably historical, statistical or scientific;
an interconnection of files.

If the IPDCP has not ruled within the time limit set by regulation, the authorisation is deemed granted (article 11).

Opinion, for the State

Processing carried out for the State, a public body, a local authority or an organisation running a public service, when it concerns public security, offences, the census, sensitive data, or salaries, pensions and taxes, is decided by regulation after a reasoned opinion of the IPDCP (article 9).

What your file must contain

Article 10 lists the information to provide: the controller's identity, the purposes, the data collected and the people concerned, the retention period, the recipients, the department handling access requests, the security measures, the use of a processor, and transfers abroad. In a press release of 15 April 2026, the IPDCP warned that an incomplete file lengthens the review and delays the receipt.

For surveillance cameras, declarations have been made online since March 2026, on the national Service Public portal, and come with a receipt and a sign to display on site. For other processing, the IPDCP's online service has been announced but is not open yet: contact the authority directly.

Processing is legitimate when the person consents to it (article 14). The law defines consent as an express, unambiguous, free, specific and informed expression of will (article 4). In a letter of 16 October 2025, the IPDCP stressed that every collection, down to an attendance sheet or a sign-up form, must respect this principle.

Consent is not required when the processing is necessary (article 14):

to perform a contract with the person, for example to deliver their order;
to comply with a legal obligation;
to carry out a task in the public interest;
to protect the person's interests or fundamental rights and freedoms.

In an app, this comes down to simple choices:

a checkbox, never pre-ticked, for each use that the service does not strictly need (newsletter, sharing with a partner);
a separate consent for each purpose, rather than a single "I accept everything" box;
a timestamp for each consent in the database, so you can prove it;
a way to withdraw consent that is as easy as giving it.

What your forms must display

When you collect data, you must tell the person (article 35):

the identity of the controller;
the purpose of the collection;
the categories of data concerned;
the recipients of the data;
whether answering is mandatory or optional, and what happens if they do not answer;
that they can ask to be removed from the file;
their rights of access and rectification;
the retention period;
any transfers abroad.

A short notice under the form, linking to a complete privacy policy, does the job. A detail many websites miss: in its October 2025 letter, the IPDCP asks organisations to stop referring to foreign standards. A privacy policy copied from a European template that cites the GDPR is therefore not appropriate: it should rely on Togolese Law No. 2019-014.

Cookies and trackers

Article 36 applies directly to cookies, advertising pixels and analytics tools. Every user must be informed clearly and completely of the purpose of any action that reads information stored on their device, or writes to it, and of the means they have to object.

Cookies strictly necessary for the service the user asked for, such as the login session or the shopping cart, are exempt. For analytics and advertising tools (Google Analytics, the Meta pixel), add a banner that explains their use and lets people refuse them as easily as they accept them. The safest approach is to load those scripts only after consent.

Marketing by text, WhatsApp and email

The law prohibits any direct marketing, by whatever means of communication, to a person who has not given prior consent (article 26). This covers commercial marketing, but also political and charitable messages (article 4).

In other words, a list of phone numbers you bought or scraped cannot be used to send promotions on WhatsApp. The person must also be offered, free of charge, the right to object to this use (article 45): include an unsubscribe link or keyword in every message. Ignoring an objection is punishable by one to five years in prison and a fine of 5 to 20 million CFA francs (article 85).

Sensitive data: health, biometrics, opinions

Processing data that reveals racial or ethnic origin, parentage, political opinions, religious or philosophical beliefs, trade union membership, sex life, genetic data or health is prohibited in principle (article 21). It remains possible in the cases listed in article 22, notably with the person's written consent.

A clinic opening online appointment booking, a school keeping medical records, a company installing a biometric time clock: these are projects to clear with the IPDCP before writing the first line of code.

Hosting data outside Togo

Most Togolese websites are hosted abroad, in Europe or the United States, and many companies use messaging tools or CRMs based outside the country. Legally, these are transfers to a third country.

A transfer is only allowed if the destination country ensures an adequate level of protection, and the IPDCP must be informed beforehand (article 28). A one-off, non-massive transfer remains possible with the person's express consent, or when it is necessary to perform a contract (article 29). Otherwise, the IPDCP can authorise it if you provide sufficient safeguards (article 30). Planned transfers must also appear in your declaration (article 10).

Worth watching: in early 2026, the authorities announced their intention to require digital operators to store Togolese citizens' data in Togo. No text imposes it yet, but an architecture that makes data easy to move (an isolated database, a replaceable provider) will spare you a costly migration if it comes.

Security, translated into technical measures

Article 52 requires the controller to take every useful precaution and spells out ten objectives. Here is how they translate into a project:

Access control: each internal user only reaches the data in their scope, through roles and permissions, with strong authentication on admin accounts.
Traceability: a log records who viewed or changed which data, and when.
Transmission: HTTPS everywhere, and no personal data in URLs or error logs.
Storage: hashed passwords (bcrypt or Argon2), encryption of the most sensitive data, keys and secrets kept out of the code.
Backups: regular copies, encrypted, tested and stored separately.
Durability: formats and tools that will still read the data in ten years (article 54).

People who handle the data must sign a confidentiality commitment, and the contract with each processor (hosting provider, agency, SMS provider) must set out its security obligations and require it to act only on your instructions (articles 20 and 51).

How long to keep data

Data must not be kept longer than needed for the purposes it was collected for (articles 16 and 53). Set a retention period for each type of data, for example three years after the last contact for a prospect, and automate deletion or anonymisation. Keeping data beyond that period is punishable by one to five years in prison and a fine of 1 to 10 million CFA francs (article 89).

Your users' rights

Your website or app must let everyone:

access their data and get a copy, charged at no more than the cost of reproduction (articles 39 and 40);
have it corrected or deleted: you have one month to do so, free of charge for the person (article 46);
have it erased: without an answer within a month, the person can refer the matter to the IPDCP, which rules within three weeks (article 47);
object to its processing on legitimate grounds, and to its use for marketing free of charge (article 45).

In practice: a dedicated contact address, a data export from the customer area, and an account deletion that really deletes the data.

The data protection officer

The law provides for a data protection officer, the equivalent of the European DPO (articles 75 to 78). The officer informs and advises, checks compliance, keeps the list of processing operations and acts as the IPDCP's point of contact. Their appointment is notified to the authority, and it exempts the organisation from declaring its processing, except for transfers abroad (article 5).

The IPDCP is actively building this role: a first group of 32 officers from banking, insurance, telecoms, health and local authorities was trained in June 2026, and press releases from September 2026 set out the expected profile and the certification requirements. Ministries and public institutions have been asked to appoint theirs.

Penalties

Administrative penalties are imposed by the IPDCP (articles 70 to 73):

a warning or a formal notice;
if the formal notice is ignored, a fine of up to 100 million CFA francs, or the withdrawal of the authorisation;
in an emergency, suspension of the processing or locking of the data for up to three months, and a penalty of up to 5 million CFA francs per day;
for processing started without the prior formalities, interim measures that can go as far as making the website or module inaccessible.

Criminal penalties are imposed by the courts (articles 79 to 93):

processing without the prior formalities, or without the required security measures: one to five years in prison and a fine of 1 to 10 million CFA francs;
fraudulent collection, or marketing despite an objection: one to five years in prison and a fine of 5 to 20 million CFA francs;
using data for another purpose than the declared one: one to five years in prison and a fine of 5 to 25 million CFA francs.

At its launch, the IPDCP announced a first phase focused on awareness before inspections. But the compliance periods set by the law, one year for businesses and two years for the State, ran out long ago (article 95): every processing operation should already comply.

Your 10-step action plan

List your processing: forms, accounts, CRM, spreadsheets, cameras, WhatsApp lists.
Identify the legal basis of each one: consent, contract or legal obligation.
Delete the data you do not use, and collect only what you need.
Rewrite your privacy notices and policy on the basis of Togolese law.
Set up an honest cookie banner, and load trackers only after consent.
Review security: access, logging, HTTPS, backups, passwords.
Set retention periods and automate the clean-up.
Plan how you will handle access, correction and deletion requests.
Cover your processors and your transfers outside Togo by contract.
Complete your formalities with the IPDCP, or appoint a data protection officer.

Frequently asked questions

Does a company website with a simple contact form need to be declared?

In principle, yes: declaration is the default regime (article 6), unless the IPDCP has published a simplified standard (article 7) or you have appointed a data protection officer (article 5). If in doubt, ask the IPDCP directly.

Is a cookie banner mandatory in Togo?

The law requires you to inform users clearly about trackers and about how to object to them (article 36). For analytics and advertising tools, a banner is the simplest way to meet that obligation.

Can I host my website or my data abroad?

Yes, provided the destination country offers an adequate level of protection, you inform the IPDCP beforehand, and you mention it in your declaration (articles 10 and 28 to 30).

Can my privacy policy cite the GDPR?

The IPDCP asks organisations to avoid references to foreign standards (letter of 16 October 2025): rely on Law No. 2019-014 instead.

How long does the IPDCP take to answer a declaration?

The receipt is issued within one month at most, which can be extended once by a reasoned decision (article 6). An incomplete file delays the review.

How do I contact the IPDCP?

By email at contact@ipdcp.tg, by phone on +228 22 25 13 34, or at its head office in Agoè 2 Lions, Lomé.

Compliance is decided in the architecture

Compliance is not solved with a legal notice page added the day before launch. It is decided in the architecture: which data to collect, where to host it, who can access it, how long to keep it. That is far easier to plan from the start than to fix afterwards.

Are you planning a platform, an app or a website redesign that handles data about customers, users or patients? Let's talk: I design systems that comply with Togolese law from the first version.

Data Protection in Togo: The 2026 Guide for Your Website and App

The essentials in 7 points

Does the law apply to your website or app?