﻿Page 1 
---------------- ~ -------------------- · ----------- -------- · - · - - ·· ------------ . . 
1 
ISLAMIC REPUBLIC OF MAURITANIA 
Honor - Brotherhood - Justice 
PRESIDENCY OF THE REPUBLIC 
CHAPTER ONE: GENERAL PROVISIONS 
Section 1: The purpose of this law 
Article 1: Without prejudice to the provisions of law n ° 2011-003 of 
January 12, 2011 repealing and replacing law n ° 96-019 of June 19, 1996, 
on the civil status code and its implementing texts, this law has 
aim to set up a normative and institutional framework for the 
processing of data in personal character. in order to guarantee 
best services and protect against · damage to privacy, 
likely to be caused by the use of 
Information and Communication. 
It lays down the conditions under which any processing relating to 
data to personal, in any form whatsoever, respect 
the fundamental rights and freedoms of citizens. 
Page 2 ----- · ------- - ---- 
2 
Section 2: Definitions 
Article 2: For the purposes of this law, the following terms are understood to mean: 
1. Code of conduct: any set of rules, including charters 
of use, developed by the data controller, in 
compliance with this law, in order to establish a correct use 
computer resources, the Internet and communications 
of the structure concerned and approved by 
the Personal Data Protection Authority; 
2. Electronic communication: ronique: any emission, transmission, or 
reception of signs, signals, writing, images or sound by 
electromagnetically, as defined by fa Law No. 2013-025 of 
July 15, 2013 on electronic communications; 
3. Consent of fa person whose data 
personnel are processed: any manifestation of 
express, unambiguous and free will by which the person 
concerned or their legal representative accepts that their data 
personal character are processed manually or 
electronic; 
4. Temporary copies: doru1.ées temporarily copied to a 
dedicated space, for a limited period of time, for 
operating requirements of the processing software; 
5. Personal data: any information, whatever 
its medium and of whatever nature, including sound and 
the image, relating to an identified or identifiable natural person 
directly or indirectly, by reference to a number 
identification or to one or more elements, specific to its 
physical, physiological, genetic, psychic, cultural identity, 
social or economic and those qualified as sensitive; 
6. Genetic data: any information concerning the characteristics 
inherited from an individual or a group of related individuals; 
7. Sensitive data: any information relating to opinions or 
religious activities ,. philosophical, political ,. unions, to life 
sev 101 1E? : .. - 1;:) _,, ---, .... e : .. l " C:" '~' é "-V 
. rl, cL I <? · , ;;;;,. '"~ .P' - I a ~ a 0CtllL / a llA 11 \ vlu.- .. · -, - ec: ·; yr-, c: d'n ~ d l_ 1.JL 'P' 'OC "] _ ,, _ ::::, a- 1 x _! and., ~ l " 
· - · 0 · 1 ··· c: 11; {-, zc "· U ..: - ,;, j ::; ~ ---- rc · {· i ·,., .-,, ~ · - · Pl1 '~ 1ec: " "' ., , L · 1: nic: t1 · ~ <-i \ - oc. · ~ - ' ...... L l ' -...} - l. l \ .... '-') vs:. , / - 'LI a_ l Jl - ..: .... L. \ __; J t • - ' J · ..1 .. _ .. c .. ~ .. ._, \ _; the. vs. '··' - J .. 1. J. '.. ._, <,,. .l Ll. l •• J 1 .. •• ._ , 1 
. . ~ .1 'TjO ~ l 
Page 3 · - · ------:; ----------.--- · -.-------- . ---------------- · ------------ · ' 
3 
8. Data in the field of health: any information 
concerning the physical and mental state of a particular person; 
9. Data File to personal any structured set 
of personal data, accessible .. according to criteria 
determined, whether this set is centralized, decentralized or 
distributed functionally 6u geographically; 
JO.Interconnexion data to character. personal: setting 
relationship of personal data processed, for a 
determined purpose, with other data processed for purposes 
identical or not; 
11. Third country: any State other than the Islamic Republic of. 
Mauritania; 
12.Responsible for processing: the natural or legal person, 
public, private or any other structure or association which, alone 
or jointly with others, make the decision to collect and 
process personal data; · 
13. Subcontractor: any natural or legal person, public or 
private, any other body or association that processes data 
on behalf of the controller; 
14.Traitement data to personal any operation 
or set of operations performed using processes 
automated or not, and applied to personal data 
personnel, such as collecting, registering, organizing, 
conservation, adaptation or modification, extraction, 
consultation, use, communication by transmission, 
dissemination or otherwise making to · provision, 
reconciliation or interconnection, as well as locking, 
encryption, erasure or destruction. 
Page 4 ~ - - . ------------ --- · - - - 
4 
Section 3: Scope of the law 
Article 3: The scope of this law on data to 
personal character includes: 
1. all data processing to personal, carried out by a 
natural person, by the State, local authorities, 
legal persons governed by public or private law; 
2.any automated or non- automated processing of the data contained or 
called to appear in a file, with the exception of processing 
mentioned in article 4 of this law; 
3.any processing carried out by a manager in the territory 
Mauritanian or in any place where Mauritanian law 'applies; 
4.any processing carried out by a person in charge, established or not on 
the territory 1nauritanien, which resorts to means of treatment 
located on national territory, with the exception of means that cannot be 
are used only for transit purposes; 
5.any processing of data relating to public security, 
defense, research ~ t prosecution of criminal offenses or the 
security of the State, even linked to any interest of the State, under 
subject to the exemptions provided for in this law and 
specific provisions in this area laid down by other laws; 
Article 4: The provisions of this law on data of a nature 
staff do not apply: 
1. to data processing carried out by a person 
physical in the exclusive context of personal activities or 
domestic, provided, however, that the data is not 
intended for unauthorized communication to third parties or to the 
diffusion; 
2.temporary copies made as part of the activities 
techniques of transmission and provision of access to a network 
11 numeric. J with a view to automatic, intermediate , and l 
transitojrç, dE; .. S. doru:!. ées and to. the exclusive purpose of allowing in other 
: ;; {: "· - ;; - ;; - . ~~ - ::: - ·: '- .. - ;, \ • C:" 1. ; 1 p r " p i r i. R ~ •: ... C:, - .. C: j-Ï-, 1~ • Vit "" \ f - ~ ;,. i > n <:; , - { 
.__, e ~ LI ~ l \ j ~ l1e v.:.,? verv1ce there . __ 1t._ .. the-t. o. CCe ~ r-10Sv_v1e allA _ .., .. orrnal .. U ".v 
tv ~ 1i ~ n ~~?: i @ { :: ro 
- · -M ....!: -... ::. 2 · - '. '-, jJ 
Page 5 
5 
CHAPTER II: FUNDAMENTAL PRINCIPLES RELATING TO 
PROCESSING OF PERSONAL DATA 
Section 1: Principles. basic data relating to the processing of personal data 
staff 
Article 5: The processing of data in personal made without 
the consent of the person concerned is prohibited 
However, exceptions may be made to the requirement of consent, 
when treatment is necessary: 
1.for compliance with a legal obligation to which the person responsible for 
treatment is submitted; 
2. at the execution of a public interest mission. or under 
the exercise of public authority vested in the person responsible for 
processing or the third party to whom the data are communicated; 
3. in the execution of a contract to which the data subject is party; 
4. to safeguard the interests or fundamental rights and freedoms 
of the person concerned. 
Article 6: The collection, storage, processing, storage and the ~ 
data transmission to personal need to make 
lawful, fair and non-fraudulent manner. 
Article 7: The data in personal must be collected for 
determined, explicit and legitimate purposes and cannot be 
further processed in a manner incompatible with the purposes 
predefined. 
They must be adequate, relevant and not excessive with regard to the 
purposes for which they are collected and subsequently processed. 
They must be kept for a period that does not exceed the 
period necessary for the purposes for which they were collected or 
processed. 
I 
'I 
Page 6 
6 
Beyond this period, personal data cannot 
be the subject of conservation only in order to respond specifically to 
processing for historical, statistical or research purposes 
under legal provisions. 
Article 8: The data to collected personal data must be 
accurate and, if necessary, updated. Any reasonable measure should be 
taken so that inaccurate or incomplete data, with regard to 
purposes for which they are collected and processed, are deleted or 
rectified. 
Article 9: The processing of data in personal occurs 
in accordance with the principle of transparency which implies 
mandatory information from the data controller. 
Article 10: The data in personal are treated so 
confidential and are protected in accordance with the provisions of 
Article 47 of this law, in particular when the processing involves 
data transmissions in a network. 
Article 11: All traite1nent data in personal made 
on behalf of the controller must be governed by an act 
legal document in writing that binds the subcontractor to the person responsible for 
processing and which provides in particular that the subcontractor acts only on 
the sole instruction of the controller and that the obligations 
provided for by this law are also incumbent on the latter. 
In lè under sub ·· contracting for activities related to trnitement 
data, any person participating in the performance of the assignment is 
subject to the obligation of confidentiality. 
Page 7 
7 
Section 2: Principles specific to the treatment of certain categories of 
personal data 
Article 12: It is forbidden to carry out the collection and any treatment which 
reveal racial, ethnic origin; liriguiStic or regional, parentage, 
political opinions, religious or philosophical convictions, 
union membership, sex life, genetic data or more 
generally those relating to Li state sarit ~ of the person concerned. 
Article 13: The prohibition set out in the previous article does not apply 
for the following categories of processing when: 
1. data processing to personal concerns of 
data manifestly made public by the person 
concerned itself; 
2.the data subject has given their consent in writing, which 
whatever the support, such a treatment ~ ment; 
3. processing of data in Rifle Character ~ e staff is required to lQ. 
safeguarding the vital interests of the data subject or of a 
other person in the event that the data subject is 
in the physical, mental or legal incapacity to give his 
consent; 
4. processing is necessary for the establishment, in · the exercise or 
defense of a legal right; 
5. judicial proceedings or a criminal investigation concerning the 
concerned person is or green; 
6. data processing to personal is necessary 
for reasons of public interest, in particular for historical purposes, 
statistics or science; 
7.the processing is necessary for the performance of a contract to which the 
the person concerned has left; 
8.the processing is necessary for compliance with a legal obligation or 
regulatory to which the controller is subject; 
9.the processing is necessary for the performance of a task of interest 
public, or is carried out by a public authority, or is assigned by 
a public authority to the controller or to a third party, 
to whom the data are communicated; 
1 
Page 8 
8 
10.the processing is carried out within the framework of the legitimate activities of a 
foundation, association or any AUTR ~ body in order not 
lucrafrf and a finality .: Polictic, philos0phiqi1e, religious ~ mumalist 
or synd'ièàle, ÎO'lüefoü ;, treatment should be report to ~ alone 
Members of this org.anisme or to persons with him 
regular contacts related to its reliability and that the data is not 
not communicated to third parties without the consent of the persons 
concerned .. 
Article 14: The trnitement data to personal r_elatif to 
offenses, criminal convictions or security measures 
may be in tnis oeu fever by: 
1. the courts, public authorities and legal persons 
managing a public service, acting within the framework of their 
attdbu tions J ~ galls ; 
2 .. the auxiliaries of justice for the strict needs of the exercise of 
their missions are entrusted by law. 
Article 15: The processing of personal data for the purposes of 
health is only legitimate: 
1. when h1 subject has given consent fate; 
2. when door SUJ · data manifestly made public 
by the data subject; 
3.when it is necessary for the defense of the vital interests of the 
data subject or another person, in the event that this 
this is found in the physical, mental or legal incapacity to 
give his cunsente1T1ent,; 
4. when it is necessary to achieve a fixedness fixed by law; 
5. When it is nécessa.üë to the promotion and to the protection of health 
public, using d- ' Lm screening, for example; 
6. lorsqthl is necess;, 1irc in preventing a certain danger · or to the 
repression of a definite criminal offense; 
7. when it is 1 • fress' i rc to the finding, to exercise or to defense 
a right to court; 
Page 9 
8.when it is necessary for preventive medicine purposes, 
medical diagnoses, the administration of care or 
treatments, either to the individual or to his parents or 
when health services act in the interest of the person 
concerned. 
Article 16: The data in character personi1el related to health are 
collected from the data subject. They cannot be 
collected from other sources only on condition that the collection is 
necessary for the purposes of the processing or that the data subject is 
not able to provide the data itself. 
Article 17: The processing of data in character staff realized the 
journalism, research or artistic or literary expression 
is allowed, when it is implemented for the sole purpose of expression 
literary and artistic or exercise, in a professional capacity, of the activity of 
journalist or researcher, in compliance with ethical rules, 
legislative or regulatory provisions of these professions. 
The provisions of this law do not preclude the application of 
provisions of the laws relating to the written or audiovisual press and 
Penal Code. 
Article 18: It is forbidden to carry out direct marketing to using 
any communication device using, in any form whatsoever, 
data on personal petsonne a physical that has not 
expressed its prior consent to receive such surveys. 
Personal data are not communicated to third parties, or 
used for marketing purposes, that once the person 
She formally expressed her agreement. 
Article 19: No court decision involving : an assessment of 
the behavior of a person; can not have louse! ' found a 
automatically maintains personal data intended for 
evaluate certain aspects of his personality. 
Page 10 
10 
No decision, producing legal effects with regard to a 
person, cannot be taken on the sole basis of treatment 
automated personal data intended to define the profi, the 
of the person concerned or to assess certain aspects of his personality. 
Section 3: Specific principles for data transfer to character 
personnel to a third country 
Article 20: The controller cannot transfer data 
data of a personal nature to a third country only if that State provides 
sufficient level of protection of privacy, freedoms and rights 
fundamental aspects of individuals with regard to the processing of which these data are or may be the subject. 
Artide 21: The Authority for Data Protection to personal 
publish and keep up to date the list of States which it considers to offer a 
sufficient level of protection of privacy, freedoms and rights 
fundamental people in regard to the processing of data to 
personal character. 
Artide 22: Before transferring data to personal to 
a third country not appearing on this list, the controller 
must first inform the Data Protection Authority at 
personal character. 
The data transfer in personal can be done according 
the conditions and rules of procedure adopted by the Authority of 
Data Protection to personal. 
Article 23: The sufficiency of a country's level of protection 
is assessed as a function, in particular, of the security measures which are 
applied, in accordance with this law, specific characteristics 
of treatment, such as its objectives, its duration and the nature of 
the origin and destination of the processed data. 
personal character ~ _: -: _ v "ffs a third party na.vs not answering · 1 - => as to the conditions • '•He 1 f · " "' 
Page 11 ' - - - - - - - - - - - - - - - - - -------- · -------- ~ ----- · ------ --- - ··· --- - - - - - - - - - - - - - - - - - - - - 11 
massive and that the person to whom the data relates has consented 
expressly upon their transfer or if the transfer is necessary for one of the 
following conditions: 
1. · to safeguard the life of that person; 
2. to safeguard the public interest; 
3. the respect of obligations. Allowing to ensure -the observation, 
the exercise or defense of legal claims; 
4. à_ the execution of a contract between the data controller and 
the person concerned. 
Article 25: The Protection Authority data in personal 
may authorize, on the basis of a duly substantiated request, a transfer 
or a set of data transfers to a third country not ensuring 
not an adequate level of protect ~ on , when the person in charge of 
processing offers sufficient guarantees with regard to the provisions of 
this law. These guarantees may result from contractual clauses 
appropriate. 
Section 4: Interconnections of files containing character data 
staff 
Article 26: The interconnection of files relating to data 
personal character constitutes processing within the meaning of point 14 of 
article 2 of this law. 
Article 27: The interconnection of files under one or more 
legal persons managing a public service, and whose purposes 
correspond to different public interests, must be the subject of 
permission of the Data Protection Authority in character 
staff. 
The same applies to processing carried out by the State for the purposes of 
put to the disposal of users of the Administration or a 
several services in remote part of the administration 
electronic. 
Page 12 
12 
Article 28: The interconnection of files belonging to private persons and 
whose main purposes are different; is also subject to 
autori_sation the Data Protection Authority in character 
staff
Page 13 
13 
Article 29: Any interco: nnexation of files must make it possible to reach legal or statutory objectives presenting a legitimate interest for the data controllers and beneficiaries or users. 
It cannot lead to discrimination or reduction of rights, 
freedoms and guarantees, for the persons concerned and must take into account the principle of relevance of the data subject to 
interconnection. 
Article 30: The request for authorization of interconnection includes all the necessary information on: 
1.the nature of the personal data relating to 
interconnection; 
2. the purpose for which the interconnection is considered necessary; 3. the duration for which interconnection is desired; 
4. and any other information useful for decision-making. 
Article 31: The demand of 1 interconnection authorization and the interconnection authorizations are entered in the directory of 
treatments. 
CHAPTER IH - FORIVJiAtXTS PREVIOUS TO THE TRAKTEI \ JIENT OF DATA A ... CHARACTER PlERSONNJEt 
Article 32: Are exempt from all formalities prior to a 
processing dor1nées to persmmel character regardless of the carrier in l 1 n '-p] 1 · r ~ ii-e' ~ l.E'l .. Pp ron 1 ~ o rrni1-é ~ yp (' l pc :: ' ·· ov {-ec. PD vio- 11 <=> l "f. ' 
l ._. vs ? '- = ~' ~ .. 1 ___ l.at. - - · - - ~ LCA. ~ ~. "b '~ ~ - .l. 
' . , .. ~ :, · ~ i • I J. 
. - , 1 ... ~lP ~ , _ ~ ha.:1:.4.i.:t· .. ~ ': l l ..... ::. · c1 ·, IL ::, : 1 1 "-.... 'll.Pri · i cn - · e' c:;:. / '-: <· {· ic l'P 4. Q 1 e 1--: p 1 · pc p · • ~ i? 1ni l 1 - J. _ _ 1 __ J 1 ... 1 L .._, 0 _ a 1 _ 1... _ ~ .._... a. L .... ._, .. _ J t ._ _ J .. ......, • 1 - 
· '"I .. ~ · -r: oj 1 _J · 
2. treatments for the sole purpose of keeping a register which ~ in 
by virtue of legislative or regulatory provisions, is intended 
exclusively on public information and is open to the 
consultation of the latter or of any person justifying an interest 
legitimate; . 
3. the treatments implemented by an association or any 
. body .to nonprofit and for religious, 
philosophical, political or union as soon as these data 
correspond to the purpose of this association or organization, 
that they only concern. their members and that they should not 
not be communicated to third parties. 
4.treatments carried out with the written consent of the 
concerned person. 
Section 2: Declaration regime 
Article 33: All data processing, apart from the cases provided for 
in Articles 32 and 37 of this law, must be subject to 
declaration to the Data Protection Authority 
staff. 
The declaration, in accordance with a model established by the Protection Authority of D9nnées to personal, includes the commitment that the 
processing meets legal requirements. 
The Data Protection Authority to personal affirm by 
an acknowledgment of receipt, that the required declaration has been made and 
immediately issues a receipt which allows the applicant to 
implement the treatment envisaged. 
Only the receipt gives the right to the implementation of processing. 
A: rtide 34: When the processing of personal data 
come under the same organization and have identical or related purposes 
between them, they can be the subject of a single declaration. 
Page 14 
14 
In this case, the information required pursuant to Article 43 of the 
this law are provided for each of the processing operations only in the 
to the extent that they are specific to it. 
Article 35: For the most common categories. of treatments 
Data on personal whose implementation is not 
likely to infringe on the privacy or freedoms 
individuals, the Protection Authority data in personal 
establishes and publishes standards designed to simplify or to exempt 
the reporting obligation. 
The standards relating to the simplified declaration specify: 
1.the purposes of the processing operations which are the subject of a declaration simplified; 
2. Data on personal or categories of data to 
personal character processed; 
3. the category or categories of data subjects; 
4.the recipients or categories of recipients to whom the 
Data on personal are disclosed; 
5. shelf life of don.nées to personal. 
These standards may take into account codes of conduct 
approved the Protection Authority data to character 
staff. 
Artide 36: The Data Protection Authority in character persorŒlel 
may define, among the categories of processing referred to in Article 35 of the 
this law, those which are exempt from declaration. To do this , 
1 ' Protection Authority data to personal wishes c01npte 
their purposes, their recipients or categories of recipients, 
Data on processed personal, the shelf life 
of these and the categories of data subjects. 
Under the conditions n1êrnes, the Authority for Protection of Doruo.ées 2 
,., 0 · 1t ~; 11-0 ·· 1 · s ! - ' \ ::'. l. . Cl ~ < o. l L ~responsible 1' ' 
personal character 
' · - · t - ., - ) l.. 
'-. ~, .. - ·' .F •• 
he "-. L \ TiOi '\, 
. -..- · -Ji 
----------------- ------------- · . - · - - ___ _______ ... Page 15 
categories of processing to make a single declaration 
in accordance with the provisions of Article 34 of. this law. 
Section 3: Authorization regime 
Article 37: Are implemented, only after authorization of the Authority of Protection of Personal Data: 
1.processing of personal data relating to 
genetic data and research in the field of. 
health; 
2. the treatments. personal data relating to 
offenses, convictions or security measures; . . 
3. the processing of personal data for the purpose of 
interconnection of files; . 
4. processing relating to a national identification number or 
any other identifier of general significance; 
5.processing of personal data comprising 
biometric data; 
6.processing of personal data having a reason 
public interest, particularly in historical, statistical or 
scientists. 
Article 38: Processing which meets the same purpose, carries 
on identical categories of data having the same 
recipients or categories of recipients, may be authorized by 
a single decision of the Data Protection Authority 
staff. In this case, the head of each treatment address to 
the Personal Data Protection Authority, a 
commitment of compliance thereof with the description in 
authorization. 
Article 39: The Personal Data Protection Authority 
make a decision within two (2) months of receipt of 
Requirement. However, this period can be renewed once, by decision motivated by its president. 
Page 16 
When the Personal Data Protection Authority does not 
has not taken a decision within these time limits, the authorization request is deemed rejected. 
Section 4: Authorization regime on the advice of the Protection Authority Data on personal 
Article 40: Except in cases where they must be authorized by law and by derogation from the provisions of the preceding articles, the processing of Data on personal operated on behalf of the state, a 
public institution or a local authority or a person 
private law companies managing a public service, are authorized by deed regulatory, taken after a reasoned opinion from the 
Data on personal character. 
These treatments relate to: 
1. state security, defense or public security; 
2.the prevention, investigation, observation or prosecution of 
criminal offenses or the execution of criminal convictions or 
security measures; 
3. the population census; 
4. data on personal showing directly 
or indirectly, the racial, edmic or regional origins, the 
parentage, political, philosophical or religious opinions or 
the trade union membership of people, or which relate to the 
health or to the sexual life of these; 
5. treating saiaïres, pensions, taxes and other 
liquidations; 
6. the implementation of the recovery of State resources. 
Artidrc 41: The Protection Authority data in personal 
seized of a request for an opinion takes a decision within two (2) months to the date of receipt of the request. However, this delay may be 
- renewed once., by reasoned decision of the chairman. 
------------ 
Page 17 
If 1 ' Protection Authority of Personal Donrtées entry does 
oe cerranes 
15 
16 
17 
not deliver until the expiry of the time limit set in the previous paragraph, the opinion is deemed favorable. 
Article 42: The regulatory act taken on the advice of the Protection Authority 
Data on personal caradère and permitting processes referred to 
Article 40 of this law specifies: 
1. the name and the purpose of the processing; 
2. the service to which the right of access is exercised; 
3. the categories of personal data recorded; 
4. the recipients or categories of recipients authorized to receive 
communication of these data; 
5. the exemptions from the information obligation provided for by the 
provisions with article 50 of this law, if it ' takes place. 
Section 5: Common provisions 
Article 43: Requests for opinions, declarations and requests 
authorizations must specify: 
1. the identity and address of the controller or, if the 
is not established on the national territory, those of its 
duly authorized representative; 
2. the purpose (s) of the processing; 
3.the interconnections envisaged or any other form of implementation 
relationship with other tr_! 3itements; 
4.the personal data processed, their origin and the 
categories of data subjects; 
5. the retention period of the processed information; 
6.the service (s) responsible for carrying out the processing, as well 
as the categories of persons who, by reason of their functions or 
for the purposes of the service, have direct access to the data 
recorded; 
7. the authorized recipients - or not - of the data communicated; 
8.the function of the person or the service with which the 
permission to access; 
Page 18 
18 
9.the measures taken to ensure the security of processing and 
Datas ; 
IO.l'indication recourse to a subcontractor, if there is any; 
11.the data transfers to · Personal envisaged to 
destination of a third country. 
Requests for opinions relating to processing relating to the safety of 
state, national defense or public security, may not 
include all the information elements listed above, under 
reserves the minimum information provided for in article 42 of this 
law. 
Article 44: The person responsible for processing already declared or authorized must make a new declaration or request for authorization from 
1 'Protection Authority data to personal, if 
change affecting the information mentioned in the previous article. 
Article 45: The notice, declaration or request for authorization may 
be sent to the Data Protection Authority 
personpel electronically, by conventional transmission on 
paper or post. 
The Protection Authority DoIL11ées to personal issues a 
receipt or acknowledgment of receipt, where applicable by electronic means. 
The Protection Authority data in personal can be 
entered by any person acting by himself, through his 
lawyer or by any other natural or legal person duly 
inandate. 
Page 19 
19 
CHAPTER IV: OBLIGATIONS RELATING TO THE CONDITIONS OF 
TREATMENT OF DATA A PERSONAL. 
Section 1: Obligation of confidentiality 
Article 46: The processing of · data to personal · is 
strictly confidential. It is carried out exclusively by people 
who act under the authority of the data controller, and only 
on his instructions. 
To carry out the processing, I responsible must choose 
persons presenting, with regard to the preservation of confidentiality 
data, all the guarantees both in terms of knowledge 
technical and legal than. that of personal integrity. Without 
prejudice to the application of the provisions of this law, a commitment 
writing is signed persons required to process such data, 
respect the confidentiality and security of data. 
The contract between the processor and the controller includes 
an indication of the obligations with regard to the protection of safety and 
data confidentiality, incumbent on the subcontractor as well as on its 
agents involved in the processing of data in personal. He 
provides that the subcontractor can only act on the instruction of the 
controller. 
Section 2: Security obligation 
Article 47: The controller is required to take all 
useful precaution with regard to the nature of the data and, in particular, for 
prevent them from being deformed, damaged, or that third parties 
authorized access. In particular, it takes any measure aimed at: 
1.Ensure that authorized persons can only access 
Data on personal within their jurisdiction; 
2. guarantee that can be verified and established, in retrospect, the identity 
of the people who had access to the information system and which 
data has been read or entered into the system, at what 
when and by what person; 
Page 20 
20 
3.guarantee that the identity of third parties can be verified and ascertained 
which data in personal can be 
transmitted; 
4.revent any unauthorized person from entering the premises and 
equipment used for data processing; 
5.prevent data carriers from being able to 
circumstance,. be read, copied, modified, erased, destroyed or 
moved by an unauthorized person; 
6.Prevent the unauthorized entry of any data into the 
information system, as well as any knowledge, any 
unauthorized modification or deletion of data 
recorded; 
7.Prevent treatment systems 
be used by people not 
data transmission installations; 
8. safeguard the data by making backup copies; 9. cool, and if necessary, convert the data to a storage persistent. 
Section 3: Duty of reconsideration 
Artide 48: Personal data cannot be kept 
beyond the time necessary to be processed for the purposes historical, statistical or scientific. 
Section 4: Obligation of perpetuity 
Axtide 49: The controller is required to take all 
of data can allowed using 
1nesure useful to ensure that the data in processed person11el character 
can be used, later 1 whatever the medium 
technique used. 
The data controller is required to safeguard the data. 
creation of backup copies, and if necessary, to convert the 
data for long-term storage. 
Page 21 
21 
CHAPTER V: RIGHTS CONFERRED ON PERSONS WHOSE 
PERSONAL DATA ARE SUBJECT TO 
. TREATMENT ·. 
Section 1: Right to information 
Article 50: When data to personal is collected 
directly to the person concerned, the person responsible for 
controller or his representative must provide to it, at the latest, when 
collection and whatever the means and supports used, the 
following information: 
1. the identity of the controller or his representative; 
2.the purpose (s) of the processing for which the data are 
destinies; 
3. the categories of data concerned; 
4.the recipient (s) to whom the data may be 
communicated; 
5.whether the answer to the questions is compulsory or 
optional, as well as the possible consequences of a 
reply; 
6.existence of a right of access, rectification and opposition to 
data; 
7. the retention period of the data; 
8.if applicable, the planned data transfers to the destination 
from abroad; 
9.the fact of being able to ask to no longer appear on the file, the 
procedure to be followed and its consequences. 
However, the provisions of this article do not apply to data 
collected and used: 
e during processing carried out on behalf of the State and 
concerning state security, national defense, security 
public or having for object the execution of sentences 
penal or measures of safety; 
Page 22 
22 
® insofar as such a limitation is necessary to comply with the 
purposes pursued by the treatment or prevention, research, 
the finding and prosecution of any infringement; 
$ when the processing is necessary to take into account a 
important economic or financial interest of the State, are included 
in the monetary, budgetary, customs and fiscal fields. 
Article 51: When the data in personal are not 
collected from the data subject, the information referred to in 
the preceding article are transmitted to the said person, at the time of 
The recording of the data or, if their communication is foreseen, to the 
later during the first communication. 
Article 52: Unless otherwise provided, any person using the 
information and communication technologies must be informed 
clearly and completely by the controller or his 
representative: 
1.of the purpose of any action tending to gain access, by way of 
electronic transmission, to information stored in its 
terminal equipment for connection, or to be registered, by the same 
vme, information in its terminal equipment 
connexion10n; 
2. the means at its disposal to oppose it. 
It is strictly forbidden to subordinate access to a service 
available on a network 
acceptance, by the subscriber or information stored in its equipment. 
electronic communications to the user concerned, the processing of 
or facilitate 1 ~ lG. 
Page 23 
23 
However, the provisions of the previous paragraph are not applicable. 
if access to the information stored in the terminal equipment of 
user or registration of information in the equipment of 
the user : 
î gold ~ r) o 1 1r Ic; the "'"' .1_ 1; 1_ ;, P ', {(__' 1 · l · ,. c; J .. \ ïEd 0p · Pr n ~ pl · t ~ e l. . _ t the ï " .: ~ tcd-d: C _, u '- c_ ._. L l .., J. 
c :: on-: mu n ica'tiG.Î1 ~ ïnar voif electronic; . 
' I • 
\ ' ' r 
. 1
2.are strictly necessary for the provision of a 
online communication at the express request of the user. Section 2: Right of access 
Article 53: Any physical person proving his identity has the right to ask, in writing, whatever the medium, the person in charge of a processing of personal data, to provide him with: 
1.information making it possible to know and possibly to contest the treatment; 
2. confirmation that data to personal the 
concerning are or are not the subject of this processing; 3. the communication, in an accessible and intelligible form, of Data on personal that concern; 
4.information relating to the purposes of processing, categories of data. of a personal nature processed and recipients to whom the data are communicated; ·. 
5.if applicable, information relating to data transfers of a personal nature intended for a third country. 
Article 54: If the person concerned so requests, the person in charge processing must provide the data subject with a copy, regardless of 
or the medium used, personal data concerning it. . 
The controller may make the issuance of this 
copy to payment of a sum not exceeding the cost of the 
reproduction. 
In case of risk of concealment or disappearance of the data to 
personal character, the data subject can inform the Authority 
of Data Protection for personal, then that takes all 
measures likely to avoid this concealment or disappearance. 
Page 24 - ------ - --- - - - - - - - - 24 
Article 55: Any person, who in the exercise of his right of access, has 
seneuses reasons to support the data that it has been 
communicated do not comply with the data processed, may 
inform the Protection Authority data to personal character 
carry out the necessary verifications . 
Article 56: The patient's right of access to personal data 
persorui.el concerning it is exercised by the patient himself or by 
the intermediary of a doctor designated by him. 
In the event of the patient's death, his spouse living with him and his children, or 
his parents (father or mother), if he is a minor, may exercise the 
right of access, through a doctor designated by them. 
Article 57: The controller data to character 
staff can object to manifestly abusive requests, 
in particular by their number, their repetitive or systematic nature. 
In case of dispute, the burden of the proof of character 
manifestly abusive requests is the responsibility of the 
treatment to which they are sent. 
Article 58: Notwithstanding the provisions of Articles 53 et seq. Of 
this law, when a treatment interests the security of the State, the 
national defense or public security, the right of access is exercised in 
the following conditions: 
1. the request is addressed to the Doru1ées Protection Authority at 
personal character, which designates one of its members (magistrate) 
to carry out the necessary investigations. This can be done 
assisted by an agent of the Multisectoral Regulatory Authority. He 
is notified to the applicant that the verifications have been carried out; 
2. when the Authority ? E Protection Dom1ées to character person} 
notes, in agreement with the controller , that the 
communication data that are contained are not turn 
cause its purposes, the security of the State, national defense or 
l 
Page 25 
25 
public security, these data may be communicated to 
applicant; 
3.when the treatment is likely to include 
information the disclosure of which would not jeopardize the 
purposes assigned to it, the regulatory act creating the 
file may provide that this information is communicated to the 
requesting by the manager of the directly entered file. 
Section 3: Right 1 opposition 
Article 59: Except in the case of a treatment responding to an obligation 
legal, any natural person has the right to oppose, free of charge, 
in that data to personal data about the be subject 
of a treatment. 
The data subject has the right, on the one hand, to be informed before 
data concerning her is for the first time 
to third parties or used for détiers account for purposes 
prospecting and, on the other hand, to be expressly offered the right to 
oppose, free of charge, said communication or use. 
Article 60: Any person concerned by processing has the right to 
oppose, subject to statutory exceptions to that data to 
personal character concerning them are the object of the lifting of secrecy 
professional. 
Section 4: Right to: rectification and deletion 
Article 61: Any natural person proving his identity may 
require the controller to rectify, depending on the case, 
supplemented, made to · day locked or deleted data to 
personal character concerning them, which are inaccurate, incomplete, 
equivocal, outdated, or whose collection, use, communication 
or retention is prohibited. 
Page 26 
26 
Article 62: When the interested party requests it in writing, regardless of 
support, the controller must justify, at no cost to the 
applicant, that he has carried out the operations required under Article 
previous one within one (1) month after the registration of the 
request. 
In the event of a dispute, the burden of proof lies with the person responsible. 
the processing for which the right of rectification is exercised. 
If data has been transmitted to a third party, the data controller is 
required to perform the necessary due diligence in order to notify him of the operations 
that he carried out in accordance with the first paragraph. 
A rticle "63: The heirs of a deceased person justifying their 
identity may, if elements brought to their attention leave them 
presume that the personal data concerning him or her making 
the subject of processing has not been updated, require the person in charge 
of this treatment that he takes into account the death and proceeds to 
put in day must be the consequence. 
When the heirs request it, the controller 
justify, at no cost to the applicant, that he carried out the operation? 
required under the previous article. 
CHAPTER VI: REGULATION ON THE PROTECTION OF 
PERSONAL DATA 
Section 1: from! ' Personal Data Protection Authority [ 
Artide 64: There shall be a Protection Authority data to character 
person.nel, responsible for ensuring that the processing of data 
personal character, in the Islamic Republic of Mauritania, be 
implemented in accordance with the provisions of this law. 
The Authority Protection DorL.nées to personal is 
rno.r person, alE: ..-- qe public law, independent, endowed with autonomy 
fi · 1 ~~ 1 .. ,, - iP , .t ._ ,. t -.__ ~ • \ -. ~ 1 · c: Y · ci · t ·· of 1 o-ec 1 r; on Elle ec. 1 • r ~ tt - rhée au Pr 0 rY ”; er } \ / [ir 'i.::::tr.o .. ~~~ CJ ~ -J._. ·. _ .._, L a 1 .. G "~ ,, _ 1; _ _ .l. ~ 1 .... ~ !.; .. ~ "'-'- · 
t • "T'Q! \ l ': - • > 1. '- " · ~: 
Page 27 
27 
It informs the data subjects and the data controllers 
of their rights. and · obligations and ensure that the use of 
Information and Communication Technologies does not include 
of lead with regard to public freedoms and private life. 
Artide 65: The composition of the Data Protection Authority ~ 
personal character, the terms and conditions of appointment of its 
members are fixed by decree. 
A Government Commissioner, appointed by the Prime Minister, 
seat to the Protection Authority · Data to Character 
Staff. The Government Commissioner is summoned to all 
meetings of the Authority, under the same conditions as the members of the 
this one. It informs the Authority on the government's orientations and on 
the motivations of the Administration concerning the implementation of 
treatments, but does not take part in the vote. 
Article 66: The Authority Protection dice data to personal 
has services placed under the authority of its Chairman. She disposes, 
in addition, a staff made available to it by the State and can provide 
the recruitment of agents according to the needs of its operation. 
Sworn officers, who may be called upon to participate in the setting up of 
carrying out the verification missions mentioned in Articles 74 and 76 
of this law, must be authorized by the Protection Authority 
Data on personal character. This authorization does not exempt from 
the application of the provisions defining the procedures authorizing 
access to secrets protected by law. 
Article 67: The mandate of the members of the Authority for the Protection of 
Data on personal, is four (4) years renewable, one 
one time. 
With the exception of the President, the members of the Authority for the Protection of 
Data on personal not exercising their functions as 
exclusive, subject to the incompatibilities provided for in article 68. 
Page 28 
28 
Members of the Data Protection Authority in character 
staff are irremovable for the duration of their mandate. Except fault 
serious, it can not be terminated to their duties in the event of resignation or 
prevention noted by the Data Protection Authority to 
personal character, under the conditions set by decree. 
Members of the Data Protection Authority in character 
personnel are bound by professional secrecy, in accordance with the texts 
in force. 
The Protection Authority data to personal establishes a 
internal regulations which specify, in particular, the rules relating to 
deliberations, to education and to the presentation folders. 
Rules relating to the organization and functioning of the Authority 
Protection of data in personal are fixed by decree. 
Article 68: Membership of the Authority for the Protection of 
Data on personal incompatible with quality 
member of the Government, exercising the functions of directors 
company, holding shares in companies in the 
computer or electronic communications sector. 
Any member of the Protection Authority data to character 
staff must inform the latter of the direct or indirect interests that 
holds or plans to hold, functions that he exercises or intends 
to exercise and any mandate he holds or plans to hold within 
of a moral person. 
If need be, the Authority will take all necessary steps to 
ensure the independence and impartiality of its members. A code of 
pipe is in place for this purpose. 
Article 69: If, during the term of office, the president or a member of 
the Authority for the Protection of D I '\ \ .., 
onr1.ees a character Dersor111el ceases l 
to perform his duties, he is replaced in the 
- -. · ..J:: .-: ...-- \. 1--. C: ---: 1 ~ ', r · lc: · -., ....-- · 1 · -,r ' P1 ... .1.- cJ · 
f ° - h u1u u. '~ pLe ,, ue ~ ~ J al lnp ~ es, _. lL · ~ .01. 
Page 29 
29 
· The mandate of the successor so appointed is limited to the period remaining to 
· run. The latter can be de ~ signed for a single mandate. 
Article 70: Members of the Data Protection Authority at . . . . . 
Personal character, before taking office, take an oath 
before the Court. supreme, siegep.nt in solemn audience, the oath 
which reads: "I swear to the noin of Allah the Almighty." good 
and faithfully. fill my. function of member of the Authority. of 
. Data Protection for personal, independently 
and impartiality, in a dignified and loyal manner, and to maintain the secrecy of 
deliberations ”. 
The other agents chosen by the Data Protection Authority to 
personnel are sworn in under the same conditions. 
Article 71: The members of the Data Protection Authority in 
personal character enjoy full immunity for opinions 
issued in the exercise or on the occasion of the exercise of their function. 
In the exercise of their attribution, the members of the Authority 
Data Protection for personal not receive instruction 
of no other authority. 
Article 72: Ministers, public authorities, company directors 
public or private, responsible for various groups and more 
generally the owners or users of processes or files 
Data on personal take all measures to 
facilitate the task of the Protection Authority data to character 
staff. Unless the law provides otherwise, and subject to the right 
Opposition to the visit referred to in section 74 of this Act, they can not 
opposition to the action of the Protection Authority data to character 
personal for any reason. 
Page 30 
30 
Section 2: Responsibilities of 1 'Data Protection Authority in character 
staff 
Article 73: The Protection Authority data in personal 
performs the following missions: 
1. it ensures to what treatments · character data 
personnel are implemented in accordance with the provisions of 
this law; 
2.it informs the persons concerned and those responsible for 
treatment of their rights and obligations. For this purpose: 
at. it receives the formalities prior to the creation of processes 
data to personn.el character; 
b. it receives complaints, petitions and complaints relating to 
to the implementation of the processing of personal data 
infonned staff and authors of the follow to celles 
Cl; 
vs. it immediately informs the public prosecutor of the 
offenses of which she is aware and she can take legal action 
for violations of the present law; 
d. it may, by special decision, entrust one or more of 
its members or agents of its departments to carry out 
verifications relating to any processing and, where applicable, 1 
obtain copies of any document or medium 
information useful for its mission; 
e. it may, under the conditions defined in Articles 77 and 
following this Act, impose sanctions in regard 
a data controller; 
f. she responds to any request for advice. 
3. it approves the codes of conduct presented to it; 
4. she holds a directory of traiten1ents donr1ées to character 
personal , to the disuosition of the forgotten; 1 r 
Page 31 
31 
5.She advises people and organizations that have recourse to 
data processing at. personal character or who proceed to 
tests or experiments likely to lead to such treatments; 
6.It lays down the conditions and rules of procedure relating to 
cross-border transfers of personal data and 
authorizes, where applicable, under the conditions provided for in this 
law; 
7. it presents to the government any suggestion likely to 
simplify and improve the legislative and regulatory framework 
1'-regard to the processing of data in character personnel; 
8. it cooperates with the data protection authorities to 
personal character of third countries, participate in negotiations 
international data protection 
staff; 
9. it publishes the authorizations granted and the opinions. issued in the 
directory processing of data in personal; 
10. it establishes, each year, an activity report submitted to the First 
Minister, Parliament and Minister in charge of 
electronic communications 
Section 3: Control and administrative and pecuniary sanctions 
Article 74: The agents of the Data Protection Authority at 
personal character, as well as sworn service agents have 
access, under the conditions provided for in the provisions of article 46 and 
following sections of the Criminal Procedure Code, relating to the repression of 
flagrant offenses, for the exercise of their missions, at the places, 
premises, enclosures, installations or establishments used for the 
implementation of a data processing with personal character and are 
professional use, excluding the parts thereof assigned to 
private home. 
The territorially competent Public Prosecutor is 
previously informed. 
- - y 
Page 32 
32 
Article 75: In the event of opposition from the person in charge of the premises, the visit cannot take place with the permission of one ' competent judicial authority 
in the jurisdiction of which are located the premises to be visited or the judge ~ 
delegated by her. This magistrate is seized at the request of the President of 
the Data Protection Authority to personal. He rules by 
a reasoned order, in urgent procedure and without obligation to 
presence. 
Article 76: The agents of the Data Protection Authority at 
personal character and the agents mentioned in article 74 of this 
law may request communication of all documents necessary to 
the accomplishment of their mission, whatever the medium, and in 
take a copy. They can collect, on site or on convocation, any 
information and any useful justification. They can access 
computer programs and data, request transcription 
of any processing in appropriate documents directly 
usable for control purposes. 
They may be assisted by experts chosen by the president of the said 
authority. 
A report of the verifications and visits is drawn up contradictorily 
carried out in application of the preceding articles. 
A: rti.de. 77: The Authority for Data Protection to personal 
can pronounce the following measures: 
1.a warning to the controller shall not 
not respecting the obligations arising from this law and the 
regulatory provisions in force. 
2.a formal notice to put an end to the breaches concerned 
within the time limit that it fixes. 
ArHde 78: If the data controller does not comply with the 
notice that it was addressed, the Authority for Data Protection 
' 1 ' 1 \ ' I Î 
has caraccere } ;. ey-serrtne1 can pïononcer has its counter, after proceoure --- J - 
con '· r · _ •. L here ~ d1_c-t' yl l, _ r:,. "': ·" <. :( - 1 ' .e ' s ~ 'he'<:: ~ 1 · "U1 1 • ct ·; ,, _ ~ u _ ,, a. - "• <:: L. ~ . .:; ii,; ~ -, 1. 1 · ec ::: · 
., - "' ') Î 
Page 33 
33 
1. a prov1s01re withdrawal of the authorization granted for a period of ~ 
maximum of three months; 
2. a definitive withdrawal of the authorization granted; final withdrawal 
can result in a temporary withdrawal period at the end of 
which the controller has not complied with 
formal notice requirements; 
3. a fine. pecuniary under the conditions provided for in Article 80 
of this law 
Article 79: In case of emergency, when the implementation of a treatment 
or operation of data to personal causes a violation 
Rights and Freedoms, the Privacy Authority data to character 
staff, after adversarial procedure, can decide: 
1. interruption of mid ~ e out of treatment for a period 
maximum of three months; 
2. lock some data to processed personal 
for a maximum period of three months; 
3. the temporary or definitive prohibition of contrary treatment 
to the provisions of this law. 
If the processing has been authorized by regulatory act under the conditions 
defined in article 42 of this law, the Authority for the Protection of 
~ S given to personal inform the Minister in charge of 
Electronic Communications so that it takes, if necessary, the 
measures to put an end to the violation found. 
The Minister then made known to the Data Protection Authority in 
personal character the follow-up given to this information, at most 
late fifteen days after receiving it. 
Article 80: In the event of breaches of legal provisions and 
regulations relating to the data to personal, apart 
above penalties, the Protection Authority data to character 
staff can take financial penalties to against 
offenders. 
Page 34 
34 
The amount of the financial penalty is proportionate to the seriousness of the 
breach. During the .1st breach, it may not exceed ten million 
(10,000,000) of ouguiyas. 
In case of breach reiterated in the five years to the date 
to which the financial penalty previously imposed has become 
final, it cannot exceed fifty million (50,000,000) ouguiya 
or, in the case of a company, 5% of the turnover excluding tax of the 
last closed financial year. 
The recovery of penalties is done in accordance with the legislation 
relating to the recovery of State debts, foreign to tax and 
to the domain. 
Article 81: The sanctions pronounced by the Authority for the Protection of 
Data on personal are taken on the basis of a report 
established by one of its members, appointed by the president of the said 
Authority. 
This report is notified to the controller, who can file 
observations and be represented or assisted. 
Airtide 82: The sanctions pronounced by the Authority for the Protection of 
Data on personal may be made public on 
decision of its president. The latter can also order, at the expense 
sanctioned persons, the inclusion of these sanctions in 
publications, newspapers or other media designated by him. 
Article 83: Sanctions and decisions taken by the Protection Authority 
Data to personr1el character may appeal to the 
Supreme Court.
Page 35 
35 
Section 4: penal provisions 
Article 84: Shall be punished by one (1) to three (3) months of imprisonment and one hundred 
thousand (100,000). to a million (1,000,000) ouguiyas fine, or 
one of these two penalties only, hindering, 
intentionally and without right, the action of the Authority for the Protection of 
Data on personal or: 
1. in opposition to the exercise of the tasks entrusted to its members or 
to authorized agents, when the visit has been authorized by the judge; 
2.by refusing to communicate to its members or agents 
empowered information and documents useful for their mission, in 
concealing such documents or information, or by 
making it disappear; 
3.by communicating information that does not comply with the 
content of the recordings, as they were when the 
request. has been made, or which do not present this content under 
a directly accessible form. 
Article 85: The fact, including negligence, of proceeding or of doing 
proceed to the processing of data in personal without 
that the formalities prior to their implementation have been complied with , 
as provided by this law, is punished from one (l) to two (2) 
months of imprisonment and from fifty (50: 000) to five hundred thousand 
(500,000) Ouguiya fine or one of these two penalties only. 
Article 86: Is punished by the same penalties provided for in the preceding article on 
makes, even by mistake, recklessness or negligence, to proceed or 
to proceed to a treatm ~ nt that has been one of the measures 
provided for in Articles 77, 78, or 79 of this law. 
Article 87: The same penalties provided for in Article 85 are punishable by 
collect data to personal data by fraudulent means, 
unfair or unlawful. 
Page 36 
36 
Article 88: The same penalties provided for in Article 85 shall be served by the fact of 
to process or have data of a personal nature 
without staff to implement the security measures provided by the 
this law. 
Article 89: Is punished by the same penalties provided for in Article 85, the fact of 
procéd_er to data processing to personal data about 
a natural person despite the latter's opposition, when this 
processing responds to prospecting purposes, in particular commercial, 
or when this opposition is based on legitimate grounds. 
Artide 90: The fact, except in the cases provided for by law, of placing or 
keep in computer memory, without the express consent of 
the applicant, data on personal that directly or 
indirectly, reveal racial or ethnic origins, 
political, philosophical or religious opinions, or affiliations 
union of people, or that are related to health or to the identity 
of these, is punished from fifteen (15) to one (1) month 
imprisonment and from fifty (50,000) to five hundred thousand (500,000) 
ouguiya a1n ende or one of these two penalties only. 
Artide 91: Is punished by the same penalties provided for in the previous article on 
fact, except in the cases provided for by law, to put or keep in memory 
computerized data to personal data about the 
offenses, convictions or judicial security measures. 
Article 92: Keeping and / or processing personal data 
staff beyond the period provided for by law or regulation, by the 
request for authorization or opinion, or by the prior declaration 
addressed to one ' Protection Authority DorŒ1ées personal data, 
is punished by fifteen (15) days to one (1) rnois of emprisonnernent and of percent 
(100,000) to five hundred thousand (500,000) ouguiya a1nende or one of these 
two sentences only, unless this conservation is carried out, in the 
conditions provided by law, to. for historical, statistical or 
scientists [ - - ~~ ·· 
'1 ' l'l • 'rri: • rr r: t 
} 
Page 37 
37 
Article 93: The fact, by any person holding personal data 
personnel at the time of their registration, their classification; of 
their transmission or any other form of processing, to divert 
this information for their purpose, as defined by law, regulation 
or · decision of the Data Protection Authority in character 
staff authorizing automated processing, or by declarations 
prior to the implementation of this treatment, is punished by one (1) to 
three (3) months imprisonment and from one hundred thousand (100,000) to one million 
(1,000,000) fine ougtiiyas or one of these two penalties 
only. 
Article 94: Except in cases where the law provides otherwise, the fact, by 
any person who has collected, during their registration, 
their classification, transmission or some other form of 
processing data to personal disclosure of which would 
the effect of undermining has the reputation of a person or to 
privacy of the latter, to wear without permission of this 
person, these data with the knowledge of a third party who does not have quality 
to receive them is punished from one (1) to three (3) months of imprisonment and 
from one hundred thousand (100,000) to one million (1,000,000) ouguiyas fine or 
of one of these two penalties only. 
The disclosure provided for in the previous paragraph, when it has been committed by 
imprudence or negligence, is punished from fifteen (15) to (2) months 
imprisonment and from fifty thousand (50,000) to two hundred (200,000) 
ouguiya fine or one of these two penalties only. 
In the cases provided for in the two preceding paragraphs, the prosecution cannot 
be exercised only on the complaint of the victim, his legal representative or 
of his beneficiaries. 
Page 38 
38 
Article 95: In the cases provided for in the above articles of this present 
section, erasing all or part of data in personal 
subject to the processing which gave rise to the infringement may be 
ordered. 
Members and officers of the data protection authority at 
personal character are authorized to note the erasure of these 
data. 
Artide 96: Legal persons other than the State, communities 
local authorities and public establishments are criminally responsible for 
offenses provided for by the present law, controlled for their count, by 
a natural person, acting either individually or as a 
member of an organ of the legal person, which exercises a power of 
leadership within it, based on: 
at. a power of representation of moral persora-1e; 
b. an authority to make decisions on behalf of the person 
1norale · f 
vs. an authority to exercise control within the person 
moral. 
The legal person can be held responsible when the absence 
monitoring or control of the part of an individual 
inentionnée the preceding paragraph has made possible the commission of 
the offense. 
The responsibility of legal persons does not exclude that of persons 
physical authors or accomplices of the same facts. 
Article 97: The penalties incurred by legal persons are: 
1.the fine, the maximum amount of which is equal to five times 
that provided for physical persortnes; 
2. the dissolution, in the case of a legal person or a 
prison sentence greater than. five (5) months: when it comes to 
1 • • ~ I 1 '- • · .., ~ 
a · u.n_ ~ r ~ n -: - i: e-Qt ct..un a.ellt co1T11Tt1 s by a person ..: ne p11ysique; 
Page 39 
39 
3. the ban on a permanent basis or for a period of five years, at the . . 
more, to exercise directly or indirectly line or several 
professional or social activities. in relation to the facts; 
4. definitive closure or for a period of five years at most, 
~ 'one or more of the establishments of the company having 
participated in committing the incriminated acts; · 
5. exclusion from public markets to permanently or for a period 
not more than five years; 
6.the seizure and confiscation of the thing which was used or was intended for 
commit the offense or the thing which is the product thereof; 
7. the posting of the pronounced court decision or the dissemination of 
this either by the written press or by any means of 
communication to the public, in particular by electronic means. 
Article 98: The public prosecutor notifies the president of 
the Data Protection Authority in personal of all 
prosecution of criminal offenses provided for by this law, 
and where appropriate, the follow-up given to them. 
He informs him of the date and purpose of the judgment hearing at least 
ten days before that date. 
The investigating or trial court may call the president of 
the Data Protection Authority in personal or 
representative to submit observations or to develop them orally at 
the audience. 
The provisions of this section apply without prejudice to 
rules relating to freedom of the press in force in the Republic Islamiqu ~ 
of Mauritania, in particular ordinance n ° 2006-017 of July 12, 2006 
on freedom of the press and its subsequent texts, and Law No. 2010-045 
of July 26, 2010, relating to audiovisual communication, as well 
than to the penalties applicable in the event of an infringement 
this freedom. 
Page 40 
40 
CHAPTER VII: TRANSITIONAL AND FINAL PROVISIONS 
Article 99: From the date of entry into force of this law and 
the effective establishment of the Data Protection Authority in 
personal character, all processing of personal data 
personnel must meet the requirements thereof, within the deadlines 
. ' 
o-after: 
1. three years, for data processing carried out on behalf of 
of the State, of a public establishment, of a local authority or 
a legal person _of private law managing a public service; 
2. two years for the processing of data in personal 
carried out on behalf of persons other than those submitted 
to the provisions of the previous point. 
Page 41 41 
Article 100: In the absence of regularization within the time limits set in article 
above, the processing operations are deemed to have been carried out without declaration . or without authorization in violation of the provisions of this law. 
Article. 101: prés.enté law will be enforced as the state and p ~ lished 
in the Official Journal of the Islamic Republic of Mauritania. 
Done at Nou 1 6, ~~ J, \} l \ 'l 
Minister of Employment, Vocational Training and Technologies 
of information and communication