OFFICIAL
JOURNAL
OF THE REPUBLIC OF TOGO
APPEARING 1
er

AND THE 16TH OF EACH MONTH AT LOME
DIRECTION, WRITING AND ADMINISTRATION

OFFICE OF THE PRESIDENT OF THE REPUBLIC - SUCH. : 22 21 27 01 LOME
ANNUAL SUBSCRIPTION

PURCHASE



TOGO................................. 20 000 F


AFRICA.......................... 28 000 F

OUT OF AFRICA ............ 40 000 F


Receipt of the statement of associations ... 10 000 F



Notice of loss of land title (1
er

and 2
e

inserts) .......................... 20 000 F


Notice of registration .............................. 10 000 F

Certification in the official journal ...................................... 500 F

NOTE : payment in advance is the only one guaranteed to be well served.
For any further information, please contact the EDITOGO Tel. : (228) 22 21 37 18 / 22 21 61 07 / 08 Fax (228) 22 22 14 89 - BP:
891 - LOME

tarif
ADS



1 of 12 pages.................. 200 F


16 to 28 pages ................. 600 F


32 to 44 pages ............... 1000 F

48 to 60 pages ............... 1500 F

Over 60 pages ......... 2 000 F

64
e

Year N° 26 ter

SPECIAL NUMBER
of the 29 October 2019
2019
29 Oct. - Law n° 2019-014 relative to the protection of data
personal...........................................................

DECREES
2019
18 Sept. - Decree n° 2019-128/PR pertaining to the appointment of the director
the inspection forest..................................................
18 Sept. - Decree n° 2019-129/PR pertaining to the appointment of the director
forest resources...............................................

SUMMARY
OFFICIAL PART

ACTS OF THE GOVERNMENT OF THE REPUBLIC
TOGO
LAWS, STATUTES, ORDINANCES, DECREES, ORDERS AND
DECISIONS

LAWS

OFFICIAL PART

ACTS OF THE GOVERNMENT OF THE REPUBLIC
TOGO
LAWS, STATUTES, ORDINANCES, DECREES, ORDERS AND
DECISIONS

LAWS

LAW N° 2019-014 29 OCTOBER 2019
RELATING TO THE PROTECTION OF PERSONAL DATA
PERSONAL
The national Assembly deliberated and adopted ;
the President of the Republic promulgates the law which reads as follows :

CHAPTER I
ER

- GENERAL PROVISIONS
First Article : the object
of this act is to regulate the collection,
processing, transmission, storage, use, and proprotection of personal data.
It guarantees that any processing of personal data
staff, under any form whatsoever, does not infringe
the fundamental rights and freedoms of the people
have to be physical.
1
20
20

2

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

29 October 2019
intermediate and transient data, and only end to
allow other recipients of the service for the best
possible access to the information transmitted.
Art. 4
: The challenge nishes
For the purposes of this act, the term :
Code of conduct : the set of rules, including the
charters of use in compliance with this act,
in order to establish a correct use of the resources informatick, networks, and electronic communications
of the structure in question and approved by the Instance of
the protection of personal data ;
Electronic Communications : emissions, transmission or reception of signs, signals, writings,
images, videos, or sounds, by means of electromagnetic
or optical ;
Temporary Copies : the copied data temporaryment in a dedicated space for a limited period of
time, for the purposes of the operation of the software
processing ;
Consent of the person concerned : any manievent will the express, unambiguous, free, specifi that and informed by the person concerned or
his legal representative, legal or conventional, agrees
that his personal data are subject to a
treatment manual or electronic form ;
Recipient of the processing of personal data
personl : any person entitled to receive communication of these data other than the data subject, the
controller, the processor and the persons
who, by reason of their duties, are responsible for dealing with
the data. However, public authorities legally
authorized, in the framework of a particular mission or
the exercise of the right of communication, may request
the controller to provide
the personal data ;
Personal data : any information
relating to a natural person identified ea or identifi able
, directly or indirectly, by reference to a number
of identification or to one or more factors specific to
his physical identity, physiological, genetic, mental,
cultural, social or economic ;
Given genetic : all data on the charters hereditary to an individual or a group of individuals
related parties ;
It also takes into account the prerogatives of the State,
the rights of local authorities, the interests of the betweentaken and civil society. It ensures that Technologies for Information and Communication technology (ICT) does
not infringe on the liberties of the individual or the public,
including the private life.
It creates a national authority for the protection
of personal data.

Art. 2 : field of application
Are subject to this law :
1) any collection, treatment, any transmission,
storage and use of personal data
personal by a natural person, by the State, the collectivités local, legal persons in public law or
private law ;
2) any processing automated or non-data-storynude or called to fi gure in a fi le, with the exception
of the treatments referred to in article 3 of this law ;
3) any processing implemented by a responsible person, such
as a challenge or to article 4, paragraph 16 of this law, on the
territory of the Republic of togo or in any place where the
law of togo applies ;
4) any processing implemented by a responsible, statelished or not on the territory of the Republic of togo, who
uses means of treatment are located on the territory
of togo, to the exclusion of the means which are used only for
the fi ns of transit through the territory ;
5) any processing of data concerning the safety
of the public, the defense, investigation and prosecution of offencestions criminal or security of the State, even related to an integratedinterest economic or fi nancial State, subject to the
derogations that defines this act and the provisions
specifi c in the matter to be fi xed by other laws.
Art. 3 : exclusions
This act does not apply to :
1) to the data processing implemented by a
natural person exclusively within the framework of its activities,
personal or household, provided that the data
are not intended to be a systematic communication
to third parties or dissemination ;
2) the temporary copies made in the course of naturetees techniques of transmission and of provision of access to
a digital network, in view of the automatic storage,

29 October 2019

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO
3
Sensitive data : all personal data
of staff relating to racial or ethnic origin, to ipasdeny or activities, religious, philosophical, political,
trade union, sexual life, health, measures
of social order, to the prosecution, the criminal sanctions or
administrative ;
Data in the field of health : any information about the physical and mental state of a person
concerned, including genetic data described above ;
File of personal data : all
structured data that is available according to criteria determinedmined, that this set is centralized, decentralized or
distributed to a functional or geographical location ;
Instance of protection of personal data
personal : the authority competent to make any
useful recommendations in order to ensure that the

treatment of personal data are set
out in accordance with the provisions of the law on
the protection of personal data ;
Interconnection of personal data :
any mechanism of connection of setting in
relation to data processed for fi nally determined
with other data processed for the fi gures identick or not, or linked by one or more officers
of the processing ;
Third countries : any State other than the Republic of togo ;
Person : any natural person who is
the object of processing of personal data ;
Direct marketing : any solicitation by means
of the sending of message, whatever the medium or
nature including commercial, political or charitable,
designed to promote, directly or indirectly, of the
goods, services or image of a person selling
goods or providing services ;
Responsible for the treatment : any natural person or
legal entity, public or private, any other body or associationassociation which, alone or jointly with others, takes the
decision to collect and process personal data,
personal and determines the fi gures ;
Subcontractor : any natural or legal person,
public or private, any other organization or association
that processes data on behalf of the responsible for the
treatment ;
Remote Service : any service to value
- added, and based on electronic communications,
which aims to enable, interactively and at a distance, to
a natural or legal person, public or private, the
ability to perform activities, steps or formaways ;
Third party : any natural person or legal entity, public or
private, any other body or association other than the
data subject, the controller, the
processor and persons who, under the authority
direct from the controller or the processor,
are authorized to process the data ;
Processing of personal data (hereinafter
designated as " processing ") : any operation or set
of operations provided for in article 2 of this law executing
killed or not by automated means or not, and
applied to data, such as collection, shoptation, recording, organisation, storage,
adaptation, change, retrieval, backup,
copy, consultation, use, disclosure by
transmission, dissemination or any other form of making
available, alignment or combination, as well as
locking, encryption, erasure or destruction
of personal data.
CHAPTER II CONFORMITY TREATMENTS
DATA ON PERSONAL
Section 1

re

: Formalities pre implementation of any processing of personal data
staf
Art. 5 : treatments subject to the provisions of the waiver
of formalities
Are exempt from the preliminary formalities provided for in
articles 6 to 9 of this act :
1) the processing referred to in article 2 of this law ;
2) the processing whose sole purpose is the keeping of a register
which according to laws or regulations
is intended solely to provide information to the public and which is
open to consultation either of it or of any person
proving a legitimate interest ;
3) the treatments for which the manager has appointed
a correspondent to the protection of personal data,
staff responsible for ensuring, in an independent manner,
the compliance with the obligations provided for in this act,
except where a transfer of personal data
to a third country is considered.

4 OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

29 October 2019

Art. 6 : treatments subject to the provisions of the declaration
Outside of the cases provided for in articles 5, 8 and 9 of the prein this act, the processing of personal data
are the subject of a declaration to the Instance of proprotection of personal data. The Instance of
protection of personal data, as attested by
an acknowledgement of receipt of any declaration. It delivers, in
a maximum period of one (01) month, a receipt, which enables the
applicant to implement the treatment, without, however,
exempt from any of his responsibilities. This period may
be extended once by a reasoned decision of the authority of
protection of personal data.

The declaration, consistent with a model established by the Instance
of the protection of personal data, has
the commitment that the processing meets the requirements of
the law. However, only the receipt of the receipt gives the right
to the implementation of a treatment.
Art. 7 : exemption from the reporting obligation
For the most common categories of processing of the
personal data, the implementation of which is
not likely to infringe the privacy or
freedoms, the Instance of the protection of data of character
staff establishes and publishes standards that are intended to simplify
or to exempt the reporting obligation.
These standards can take into account the code of
conduct approved by the authority for the protection of
personal data.
Art. 8 : salaries subject to the authorisation regime

Are implemented after approval of the Instance of
the protection of personal data :
1) processing of personal data porboth genetic data and research in
the field of health ;
2) the treatment of personal data porboth on data relating to offences, condemnedtions or security measures ;
3) processing of personal data having
to ob
jet a interconnect fi les, such as challenge ned
in article 33 of this law ;
4) processing of personal data porboth on a national number identification or any other
identifier of general application ;
5) the treatment of personal data comwearing biometric data ;
6) processing of personal data having
a reason in the public interest, including fi ns historical,
statistical or scientific ques.

Art. 9 : treatment subject to the regime of the application
notice
Except in cases where they must be authorized by the law and by
way of derogation from the provisions of the preceding articles, the treatments automatisés of personal data carried for the account of
the State, of a public institution or a local authority
or a legal person of private law, the manager of the service
public are determined by regulatory act taken after notice
motivated the Instance of the protection of personal data
of staff.
These treatments include :
1) State security, defence or public security ;
2) the prevention, investigation, determination, or prosecution
of criminal offences or the execution of sentences
in criminal or security measures ;

3) the census of the population ;
4) the data of a personal nature which arise,
directly or indirectly, the origins of racial, ethnic, fi re, political opinions, philosophical,
religious or trade-union membership of persons,
or which are related to health or sex life of
those when they do not fall under article 10.3 of
this act ;
5) the treatment of wages, pensions, income taxes, and
other liquidations.
Section 2 : provisions common to the formalitees prerequisites
Art. 10 : The content of the applications and statements
Requests for opinions, statements and requests
for permission should specify :

1) the identity and address of the person responsible for the treatment, or,
if it is not established on the national territory, those of
its duly authorised representative ;
2) the fi gures of the processing, and the description
general of his duties ;

29 October 2019

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO 5

3) the interconnections considered, or other forms
of contact with other treatments.
4) the personal data to be processed, their origin and
the categories of persons affected by the processing ;
5) duration of storage of information to be processed ;
6) the service or services responsible for the implementation of the treatyment as well as the categories of persons who, by reason
of their duties or for the needs of the service, have
direct access to the recorded data ;
7) the recipient entitled to receive communication of the
data ;
8) the function of the person or the department to which
is exercised the right of access ;
9) the measures taken to ensure the safety of the traibehaviours and data ;
10) the indication of the use of a sub-contractor ;
11) the transfers of personal data
considered to destination in a third country, subject to
reciprocity.
The head of a treatment already declared or authorized
introduced a new application at the Instance of the
protection of personal data in the event of a
change affecting the information referred to in the alinéa previous. In addition, it informs the Instance of protection
of personal data in the event of removal
of the treatment.
Art.11 : time of the processing of applications
The Instance of the protection of personal data, personnel is pronounced within a period to be specified by way
of regulation of receipt of the demand
notice or permission. However, this period may be extended
once by a reasoned decision of the authority of protection
of personal data. When the Instance
of protection of the personal data is
not pronounced in these times, the authorisation is deemed
to be favourable.
Art. 12 : for the transmission Of reports and requests
In the opinion, the statement or the authorization request may be
sent to the Instance of the protection of data of character
staff electronically or via postal mail. Instance of protection of personal data
shall issue a receipt by post or by
electronic means.
Art. 13 : the reference to the Instance of the protection of giftborn personal
The Instance of protection of personal data
may be entered by any person, acting by itself,
through its counsel or by any other person

or entity duly authorized.
Section 3 : basic principles governing the traitement of personal data
Art. 14 : The principle of consent and legitimacy
The processing of personal data is the
considered as legitimate if the person concerned gives his / her
consent.
However, there may be exceptions to this requirement where the
processing is necessary :
1) in respect of a legal obligation to which the responsibility
sand of treatment is submitted ;

2) the performance of a task in the public interest or in
the exercise of official authority vested in the resperson in charge of the treatment or the third parties to whom the data are
disclosed ;
3) the performance of a contract to which the person concerned
is a party or execution of pre-contractual measures
taken at its request ;
4) to safeguard the interest or rights and freedoms fondamentaux of the person concerned.
Art. 15 : The principle of lawfulness and fairness
The collection, registration, processing, storage and
transmission of personal data are
lawfully, fairly and in a non-fraudulent.
Art. 16
: The principle of fi nality, relevance and conserconservation
The data are collected for the fi gures determinborn, explicit and legitimate and may not be processed
subsequently in a way that is inconsistent with these fi gures.

It must be adequate, relevant and not excessive
in view of the fi gures for which they are collected
and subsequently processed.
They must be kept for a period that
does not exceed the period necessary for the fi gures for

6 OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

29 October 2019

which they were collected or processed. Beyond
this period, the data can not be the subject
of a conservation that in order to meet specifi cally
to a treatment of the fi ns historical, statistical or
research pursuant to legal provisions.
Art. 17 : The principle of accuracy
The data collected must be accurate and, where necessary
saire, updates. All reasonable measures shall be taken
to ensure that data which are inaccurate or incomplete, having regard to
the fi gures for which they are collected and processed
later, are erased or rectifi ed.
Art. 18 : The principle of transparency
It involves a mandatory information of the share of the responsibility
sand processing personal data
personal.
Art. 19
: The principle of confi privacy and security
The personal data shall be treated as
confi dentielle and protected in accordance with the provisions
of articles 51 and 52 of this law, in particular where
the processing involves the transmission of data in
a network.
Art. 20 : The principle of the choice of the subcontractor
When the treatment is implemented for the account of the
responsible of the treatment, the treatment must choose a subcontractor who offers guarantees enough santes. The nature of
these guarantees is fi xed by the regulatory process. It is the responsibility of
the person responsible for the processing, as well as the sub-contractor to
ensure compliance with the security measures challenge as defined by article
52 of this law.
Any processing performed for the account of the responsible for the
processing should be governed by a contract or legal instrument
in writing which binds the subcontractor to the responsible
of the treatment and which provides, in particular, that the sub-traias acts only on the instruction of the head of the
treatment and that the obligations referred to in this article
shall also be incumbent on the latter.
Any person who acts under the authority of the head
of the treatment or of the subcontractor, and the
subcontractor himself, and who is accessing data
of a personal nature may not process them except on instructions
from the controller.
Section 4 : basic principles governing the
processing of sensitive data
Art. 21 : the prohibition of the processing of giftborn sensitive
It is forbidden to the collection and to any treatment which

reveal racial or ethnic origin, fi re, opinions,
political, religious or philosophical beliefs,
trade union membership, sexual life, data
on genetic or, more generally, those relating to the state
of health of the person concerned.
Art. 22 : the exception to the principle of the prohibition
The prohibition laid down in article 21 of this law does
not apply to the categories of treatments following
when :
1) the processing of personal data door
to data which are manifestly made public by the
person concerned ;
2) the person concerned has given his or her consent in
writing to such processing and in accordance with the laws
in force ;
3) the processing of personal data is
necessary to protect the vital interests of the personne data subject or of another person where
the person concerned is unable physical
or legal consent ;
4) the processing is necessary for the establishment, exercise
or defence of a right in court. However, data
on genetic may only be processed for vérifi er the therexistence of a genetic link in the administration
of evidence in court, for the identifi cation of a person,
prevention or suppression of a criminal offence is
to be determined ;
5) a judicial proceeding or a criminal investigation is
opened ;
6) the processing of personal data is
necessary for reasons of public interest, including
fi ns historical, statistical, scientific ques or cultural ;
7) the processing is necessary for the performance of a contract
to which the person concerned is a party or execution
of pre-contractual measures taken at the request of the
person concerned during the period of pre-contractual ;
8) the processing is necessary for the fulfillment of an obligation
of a law or regulation to which the head of the traitement is subject ;

29 October 2019

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO
7
9) the processing is necessary for the performance of a task
of public interest or is carried out by a public authority
or is assigned by a public authority responsible for
the processing, or to a third party to whom the data are communiquées.
Art. 23 : The processing of data relating to offences
The processing of data relating to offences,
criminal convictions or security measures may
be implemented by :
1) the courts, the public authorities and the people
morales managing a public service, acting in the framework
of their legal attributions ;

2) the officers of the court to the strict requirements of
the performance of tasks that are entrusted to esa by the law.
Art. 24 : The processing of health data
The processing of personal data of the fi ns
of health is not legal :
1) when the person concerned has given his / her consentment ;
2) when it relates to data which are manifestly made
public by the person concerned ;
3) when it is necessary to protect the vital interests
of the person concerned or of another person in
the cases where it is located in the physical and / or
legal consent ;
4) when it is necessary to the achievement of a fi nally fi xed
by or under the act ;
5) when it is necessary to the promotion and protection
of the public health including screening ;

6) when it is necessary for the prevention of a hazard,
concrete, or the suppression of a criminal offence is to be determined ;
7) when it is necessary for the establishment, exercise or
defence of a right in court ;
8) when it is necessary to fi ns of preventive medicine,
medical diagnoses, the provision of care or
treatment or to the person concerned, or to his parent
or when the health services act in the best interest of
the person concerned. The data are processed under the
supervision of a health care professional who is
subject to professional secrecy.
The personal data relating to health
are collected from the person concerned. They
can be collected from other sources to condition that the collection is necessary for the purpose of treatment
or that the person concerned is not able to
provide the data itself.

Art. 25 : Of the application of the provisions of the laws relating
to the press or to the audiovisual sector and the code
of criminal
The provisions of this act shall not preclude
the application of the provisions of the laws relating to the press
, written or audiovisual, and of the criminal code that provide for the
conditions for the exercise of the right of reply, and prevent,
limit, repair and, if necessary, to repress those abuses
to the privacy and reputation of individuals.
Art.26 : prohibition Of direct marketing
It is prohibited any direct marketing through any means
of communication, using, in any form
, the personal data of a person
physical who has not expressed their consent
to receive such surveys.

Art. 27 : on The basis of a decision of justice
No court decision involving a review
on the behaviour of a person may not have the
sole basis for an automated processing of data of
a personal nature intended to assess certain aspects of
his personality.
No decision producing legal effects in respect
of a person cannot be taken based solely on an
automated processing of personal data
intended to challenge nir the profi le of the person concerned, or to evaluate certain
aspects of his personality.
Are not made solely on the basis of a processing
automated personal data, the deciof the decisions adopted in the framework of the conclusion or execution
of a contract and for which the person concerned has
been set to submit its observations, or those
satisfying the requests of the data subject.

Art. 28 : transfer of personal data
to a third country
The controller may transfer
personal data to a third country, if
the State provides a level of protection sufficient life
private, fundamental rights and freedoms of individuals
with regard to the processing for which the data are or may
be subjected.

8 OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

29 October 2019

Prior to any transfer of personal data
to a third country, the controller must providelablement inform the Instance of the protection of data of
a personal nature which gives a reasoned opinion.
Art. 29 : the admission Of one-time transfers of
personal data
The controller can transfer data
to a third country do not meet
the conditions laid down in the preceding article, if the transfer
is one-time, non solid, and that the person to which
the data relates has expressly consented to their
transfer or if the transfer is necessary for one of the conditions of the following :
1) for the protection of the life of that person ;
2) for the protection of the public interest ;
3) in respect of obligations to ensure the constatation, exercise or defence of legal claims ;
4) the performance of a contract between the manager of the treatyment and the person concerned, or of pre-contractual measures taken
at the request of the latter.
Art. 30 : authorization to transfer to a third country
and which does not ensure an adequate level of protection
The Instance of the protection of data of a personal nature
may authorize, on the basis of a reasoned request,
a transfer or a set of transfers of data to
a third country, and which does not ensure a level of protection
adequate, this is where the controller offers
guarantees enough santes to the regard to the protection of the lives
private, fundamental rights and freedoms of individuals
concerned as well as to the exercise of the corresponding rights.
Art. 31 : The processing of personal data
from foreign countries
Prior to any processing of personal data
from abroad, the Instance of the protection of giftborn of a personal nature must first, vérifi er
that the controller provides a level of
protection sufficient for the privacy, rights and freedoms
fundamental of individuals with regard to the processing
under this act.
The character sufficient level of protection provided by
a manager of the treatment is assessed according to notamment of the security measures which are applied in
accordance with this law, the specific characteristics of the
treatment, such as fi gures, its duration as well as the
nature, the origin and the destination of the processed data.

Section 5 : the interconnection of the fi le comporboth of personal data
Art. 32 : the requirement Of permission from the interconnection
of fi les containing data of a personal nature
The interconnection of fi les referred to in article 10.3 of the prein this act under one or more persons
managing a public service and for which the fi gures correspond
to different public interests is the subject of an authorization for the Instance of the protection of personal data
of staff.
It is the same for the processing implemented by
the State to the fi ns to put at the disposal of the users of
the administration of one or more remote services, in
the context of e-government.
The interconnection of fi les that do not fall within individuals
and private that the fi gures are the key different is
also subject to authorization of the Instance of protection of personal data.
Art. 33 : application For approval of interconnection
The authorization request interconnection includes
information on :
1) the nature of the personal data relating to
the interconnect.
2) the fi nality for which the interconnection is considered
necessary ;
3) the duration for which the interconnection is permitted ;
4) if applicable, the terms and conditions in the light
of the
protection is the most effi cient, rights and freedoms,
notably the right to privacy of the persons concernedborn or of third parties.
The authorisation may be renewed after a request by the
responsible of the treatment.
The application for approval of interconnection as well as the
permissions of interconnection are listed on the directory
of treatments mentioned in section 56.4 of the act.
Art. 34 : the requirement of legitimacy of the interconnection of
fi les containing data of a personal nature

29 October 2019

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

9

The interconnection of fi les should be able to achieve
statutory objectives, or statutory interest
legitimate for the responsible of the treatment. It does
not lead to discrimination or reduction of
rights, freedoms and guarantees for the persons concerned,
or be subject to appropriate security measures and shall
take into account the principle of relevance of the data to which
the subject of the interconnection.
CHAPTER III - RIGHTS OF THE PERSON WHOSE

DATA ARE SUBJECT To TREATMENT
Section 1 : the right to information
Art. 35 : Of the information to be communicated in general
When personal data are collected
directly from the person concerned, the responsiblesand of the treatment is to communicate to the latter, more
later, during the collection of information, and by whatever means and
media used, the following information :
1) the identity of the controller and, where applicable,
his representative ;
2) the fi gures determined of the processing for which the
data are intended ;
3) the categories of data concerned ;

4) the recipients or categories of recipients
to whom the data are likely to be communiapplied ;
5) the mandatory or not to answer the questions
, and the possible consequences of failure to reply ;
6) the opportunity to ask not to fi gure on the fi le ;
7) the existence of a right of access to data relating to them
and rectifi cation of such data ;
8) duration of storage of the data ;
9) where applicable, transfers of personal data
personal envisaged to another foreign destination.
Art. 36 : Of the information to provide to the users
electronic communication networks
Any person user of communication networks and
electronic must be informed in a clear and comrounds by the controller or his representative :

1) of the fi nality of any action in order to have access to, by way
of electronic transmission, to the information stored
in the terminal equipment of the connection, or to register,
by the same way, the information in the equipment
terminal connection ;
2) the means at its disposal to oppose it.
These provisions are not applicable if the access to the
information stored in the terminal equipment of the utiuser or the recording of information in the equipment
of the user :
1) has fi nally exclusive to enable or facilitate the comcommunications by electronic means ;
2) is strictly necessary for the provision of a service
of online communication at the express request of
the user.
Art. 37 : the transmission Of information

When the personal data are not
collected from the person concerned, the information referred to in article 36 of this law shall be transmitted
to such person at the time of registration of the giftborn, or, if their communication is envisaged, at the latest, when
the first communication.
Art. 38 : limitations on the right to information
The provisions of article 36 of this law is apcompliance not :
1) data collected and used when the treatment is
implemented for the account of the State and of interest to the
State security, defence, public safety or having
for their object the execution of criminal convictions or
security measures, to the extent such a limitation is
necessary in respect of the fi ns pursued by the treatment ;
2) where the processing is necessary for the prevention,
research, observation, and for the prosecution of any offence ;

(3) where the processing is necessary for the consideration
of an interest in economic
ique or fi nancial important to the State, are
included in the areas of monetary, fiscal, customs
and fi scal.
Section 2 : The right of access
Art. 39 : domain of the right of access

10 OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

29 October 2019

Any person proving his / her identity has the right
to request, in writing, regardless of the medium, the responsibility
sand processing of personal data,
provide :
1) the information required to know and to challenge
the treatment ;
2) the confi rmation that the personal data
relating to him are or are not the subject of such treatment ;
3) the communication in an intelligible form, of the giftborn to personal concern as well as
any available information as to their source ;
4) information related to the fi gures of the processing, the
categories of personal data processed and the
recipients or categories of recipients to whom
the data are disclosed ;
5) where applicable, information relating to transfers
of personal data is envisaged to any
other person responsible for the processing, or destined
to a third country.
Art. 40 : the issuing Of a copy of the data
of a personal nature
A copy of the personal data is issued
to the person concerned at his request. The responsible of the
treatment may make the delivery of this copy
of the payment of a sum which will not exceed the cost of
reproduction.
In the event of a risk of concealment or disappearance of the
personal data, the person concerned
may inform the Instance of the protection of data of
a personal nature that takes any other action of a nature to
prevent the concealment or disappearance.
Art. 41 : The control of the effectiveness of the right of access
Any person who, in the exercise of its right of access has
serious reasons to admit that the data that
have been reported are not consistent with the data
processed may inform the Instance of the protection of giftborn of a personal nature which will vérifi cations
necessary.
Art. 42 : The right to access patient
The right of access to a patient is exercised by the patient himor herself or through a doctor as he may designate.
In the event of death of the patient, his / her spouse and children,
if he is a minor, his father, mother or guardian, any other
assigns, and any person proving a possession
of the state has a permission of a judge may exercise,
by a physician that they shall designate in writing,

the right of access.
Art. 43 : requests that are clearly abusive

The controller may object in writing to the
manifestly unfair, especially by their
number, their repetitive or systematic nature. In the event of a
dispute, the burden of proof of the eventcompletely unfair of applications is the responsibility of the responsible of the
treatment to which they are addressed.
Art. 44 : the exercise Of the right of access to and processing interested
sant State security, defence or public safety
By way of derogation from articles 39 and following of this law,
when a treatment is of interest to the State security, defence
or public security, the right of access is exercised in the
following conditions :
1) the request is sent to the Instance of the protection
of personal data, which designates one of
its members belonging, or having belonged, to the Court
supreme to conduct the necessary investigations. This
can be done with the assistance of another officer of the Instance of
the protection of personal data. It is given y
the applicant that he has been made the vérifi cation ;

2) when the Instance of the protection of personal data,
personal notes, in agreement with the responsible of the
treatment, that the communication of the data
contained herein does not question his fi gures, the safety
of the State, defence or public security, the data
may be communicated to the applicant ;
3) when the treatment is likely to include
information the disclosure of which would not
cause the fi ns that are assigned to him, the regulatory act
establishing the fi le may provide that such information
may be communicated to the applicant by the managementnary of the fi le directly entered.
Section 3 : right of opposition
Art. 45 : The field of the right of opposition
Any natural person has the right to object, for
legitimate reasons, to the data character, personnel concerning the object of a treatment.

29 October 2019

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO 11
She has the right, on the one hand, and to be informed before
data relating to them are for the first time
communicated to third parties or used for the account of
third parties to the fi ns of prospecting and, on the other hand, to be
expressly offered the right to oppose, free of charge, to
said communication or use.
The provisions of the first paragraph of this article shall
not apply if the processing is obligation legal.
Section 4 : The law of rectifi cation and removal
Art. 46 : The realm of the right to rectification and
deletion
Any person proving his identity may
require the controller to be, according to
the case, rectifi ed, completed, updated, locked
or deleted, the personal data
concerning them, which are inaccurate, incomplete, equivocal,
out of date, or whose collection, use, communication
or conservation is prohibited.
When the interested party makes the request in writing, no
matter the medium, the controller must be justified er,
at no cost to the applicant, that it has made the operations
required under the first paragraph of this article within
a period of one (1) month after the registration of the application.
In case of dispute, the burden of proof is on
the person responsible for the treatment to which is exercised the
right of access.
If data has been transmitted to a third party, the responsible
of the treatment is to perform the necessary steps in order for him to
be given to er operations that it has conducted pursuant to the
first paragraph of this article.
Section 5 : right to erasure
Art. 47 : implementation of the right to erasure
Where the controller has made public
the personal data of the person concerned-

born, it shall take all reasonable steps, including
technical measures, in relation to the data
published under his / her responsibility, in order to inform third parties
that process the data that a person concerned
asks them to delete all links to these data to chartry personnel, or any copy or reproduction thereof.

Where the controller has authorised a third party to
publish the personal data of the person
concerned, he is deemed responsible for this publication and
shall take all appropriate measures to implement
the right to be forgotten and to erasure of data
of a personal nature.
In the case of non-execution of the deletion of the data
of a personal nature, or in the case of lack of response from the
responsible of the treatment, in a period of one (01) month on
the date of the application, the person concerned may refer
the Instance of protection of personal data
, which shall act on the application within a period of three
(03) weeks from the date of the claim.

Art. 48 : mechanisms For ensuring the effectiveness of the right to
erasure
The controller has put in place mechanisms
appropriate to ensure the implementation of the respect for the right
to be forgotten and to erasure of the data to chartry or personnel shall periodically review the need to
retain such data in accordance with the provisions of
this act.
When the erase is done, the manager of the treatyment does not carry out any other processing of these data
of a personal nature.
Art. 49 : conditions of implementation of the right to
erasure
The Instance of protection of personal data
adopted measures and guidelines to the fi ns of prespecify the conditions for erasure of the personal data,
the staff, the removal of links to these data,
copies or reproductions thereof.

Section 6 : backup of personal data
staf after the death
Art. 50 : the right to update personal data
personal after the death
The successors of a deceased person proving their
identity may require the responsible of this treatment is that it
takes into consideration the death of the person concerned
and shall make the necessary updates.
When the right-holders so request, the responsible
of the treatment must be justified er, at no cost to the applicant,
that it has carried out the required operations under paragraph
preceding.

12

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

29 October 2019

CHAPTER IV - OBLIGATIONS OF THE RESPONSIBLE
TREATMENT OF DATA IN NATURE
STAFF
Art. 51
: Obligation of confi privacy
The processing of personal data is confi dentiel. It is performed exclusively by persons
acting under the authority of the head of the treatment
, and only on his instructions.
For the realization of the processing, the manager chooses
persons with regard to the preservation
of the confi privacy of the data, all warranties as
to technical and legal knowledge that integrity
personal. A written commitment of the people likely
to treat such data to comply with this law needs to
be signed.
The contract between a subcontractor responsible for the treatyment includes an indication of the obligations of the
subcontractor in respect of the protection of the safety and
confi privacy of data, and provides that the subcontractor does
may act only on instructions from the controller.
Art. 52 : obligation of security
The responsible of the treatment is required to take all
necessary precautions in view of the nature of the data and,
in particular, to prevent them from being distorted,
damaged or unauthorized third parties
access. It takes, therefore, any measure aimed at :
1) to ensure that, for the use of a milking systemment of automated data-authorised persons must
have access to the personal data
under their jurisdiction ;
2) to ensure that it can be checked ea and recognized the identity of
third parties to whom the personal data may
be transmitted ;
3) to ensure that it can be checked ea and recognized a posteriori
identity of the people who have had access to the system information, and which data has been read or introduced in
the system, and at what time ;
4) prevent any unauthorised person to gain access to the

premises and equipment used for the processing of the
data ;

5) prevent data carriers can be
read, copied, modified, és, destroyed, or moved by a person
not permitted ;
6) prevent the introduction of unauthorized possession of any data
in the information system as well as any
knowledge, any change or deletion not
allowed of recorded data ;
7) prevent processing systems data
can be used by unauthorised persons
using data communication equipment ;
8) prevent that, during communication of data and
transport of storage media, the data can
be read, copied, modified, esa or deletion of non authorized ;
9) save the data by the constitution of copies
of security ;
10) refresh and, if necessary, convert the data to
a storage perennial.

Art. 53 : Of the storage obligation
The personal data may be
retained beyond the time necessary in order to be
processed for the fi ns historical, statistical, cultural, or
scientific ques. In this case, the controller
shall inform the IPDCP and the person concerned.
Except with the express consent of the person concerned, the
personal data collected by the prestataires services certifi cation and electronics for the
needs of the grant and the conservation of certifi cats
related to electronic signatures must be made directly
with the person concerned and may only be processed
for the fi ns for which they were collected.

Art. 54 : obligation of sustainability
The responsible of the treatment is required to take all
necessary measures to ensure that the personal data
of staff processed can be exploited regardless of
the support used. It ensures in particular
that the evolution of the technology will not be an obstacle
to the operation.
CHAPTER V - THE INSTITUTIONAL FRAMEWORK OF THE
DATA PROTECTION NATURE
STAFF
Art. 55 : the creation and the status of the Instance of protection of personal data
There is hereby established a national authority for the protection
of personal data referred to as " Instance

29 October 2019

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO 13
Protection of Personal Data ", in
short " IPDCP ".
The Instance of protection of personal data
is an independent administrative authority responsible for
ensuring that the treatment of the personal data,
personnel shall be implemented in accordance with the available
provisions of this act.
It shall inform the persons concerned and the responsible
treatment of their rights and obligations, and ensure that
ICT does not include a threat in the light of the freedom
of public and private life.
The rules relating to the organisation and operation of
the Instance of the protection of personal data
are fi xed by a decree of the council of ministers.
Art. 56 : missions to the Instance of the protection of giftborn personal
The Instance of protection of personal data,
carries out the following missions :
1) to ensure that the processing of personal data
is implemented in accordance with the available
provisions of this act ;
2) inform the persons concerned and the responsible
treatment of their rights and obligations. Has this effect :
(a) it receives the formalities prior to the implementation
of treatments of personal data ;
(b) it receives complaints, petitions, and complaints
relating to the processing of data
of a personal nature and shall inform their authors suites
data to them ;
(c) it shall without delay inform the Prosecutor of the Republic
of the offences of which it has knowledge ;
d) it may, by special decision, upload one or moreseveral of its members or agents of its services to
make vérifi cations covering the whole processing and,
if necessary, to obtain copies of any document or
information useful to its mission ;
e) it may, in the conditions challenge as defined by article 71 of
this act be pronounced a sanction against a responsibility

sand processing ;
(f) it shall respond to any request for an opinion ;
3) approve the charters of use, which are mainly
dealt with ;
4) keep a directory of the organs of treatments of giftborn personal available to the public ;
5) advise the persons and organizations who have recourse
to the treatment of the personal data or
to conduct tests or experiments of nature to lead
to such treatments ;
6) to authorize, under the conditions laid down by this
law, cross-border transfers of personal data
personal ;
7) to present to the Government's suggestion is likely
to simplify and improve the legislative framework and regulatorysilent with regard to the processing of data ;
8) cooperate with the authorities of data protection
of personal character of the third countries and participate in
international negotiations on the protection of
personal data ;
9) publish the permissions granted and the notice issued in
the directory of the treatment of personal data
of staff ;
10) prepare an annual report of activities addressed to the
President of the Republic, the Prime minister, the prepresident of the national Assembly and the president of the Senate.
Art. 57 : the composition Of the Instance of the protection of
personal data
The bodies of the Instance of the protection of data of
a personal nature are :
- the committee of management ;
- the operating committee.
The executive committee of the Instance of the protection of
personal data is composed of ten (10)
members have been selected, because of their legal skill
or technique, as follows :
1) three (03) persons appointed by the President of
the Republic ;
2) a (01) a deputy appointed by the national Assembly ;
3) a (01) a senator appointed by the Senate ;
4) a (01) representative from the private sector appointed by the
conseil national du patronat ;
5) one (01) judge appointed by the higher council of the
judiciary ;

14

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

29 October 2019

(6) a (01) a lawyer appointed by the President of the bar association of
lawyers ;
7) a (01) a representative of the COMMISSION designated by the chairman
of the COMMISSION ;
8) the director of the national Agency for cybersecurity
(ANCY).
In the case of equality of votes, during the discussions, the
president has the casting vote.
The members of the executive committee of the Instance of proprotection of personal data are appointed
by decree.
A Government commissioner, appointed by the Premier minister, the seat at the Instance of the protection
of personal data. The commissioner of the
Government is invited to all sessions in the Instance
of protection of personal data, in the
same conditions as the members of it. It informs
the IPDCP on the guidelines of the Government and on the
motivations of the administration on the implementation
of the treatment but does not take part in the vote.
The operational committee of the Instance of the protection of
personal data is composed of a management
legal and technical direction placed under selfauthority of the president of the Instance. It has, in addition, a
staff placed at its disposal by the State and may provide
for the recruitment of officers in accordance with the provisions
of the labour code.

The sworn agents, pursuant to paragraph 2 of
article 62 of this law and who may be called upon to
participate in the implementation of the missions of vérifi cation
referred to in article 56 of this act, must
be authorised by the Instance of the protection of data of
a personal nature. This authorization shall not prevent
the application of the provisions defining the procedures for
authorizing access to the secrets protected by law.
Art. 58 : the presidency of the Instance of the protection of
personal data
The President of the Republic shall appoint by decree by the prepresident of the IPDCP among the members of the executive committee
of the said Instance.
Art. 59 : The mandate of the members of the executive committee of
the Instance of the protection of personal data
The term of office of members of the executive committee of
the IPDCP is three (03) years, renewable once. They
are non-removable.
The exception of the chairman, the members of the committee of direction of the Instance of the protection of personal data,
personnel do not exert their function on an exclusive basis.

It can only be put an end to the functions of a member, that in the event
of resignation or incapacity found by the Instance of
the protection of personal data.
The members of the executive committee of the Instance of proprotection of personal data are subject to
professional secrecy pursuant to the legislation in force.
The Instance of the protection of personal data, personnel shall establish internal rules and regulations, which stipulates, inter alia,
the rules relating to the deliberations, to the instruction and
presentation folders.
Art. 60 : incompatibilities related to the quality of member of the
executive committee of the Instance of the protection of data
of a personal nature

The quality of member of the executive committee of the Instance
of the protection of personal data is incomcompatible with the quality of member of the Government. It
is also incompatible with the exercise of the functions of
a leader in the business sector of the computing
or electronic communications, or detention of
participation in those.
Any member of the executive committee of the Instance of proprotection of personal data should inform
it of a direct or indirect interest that it owns or
comes to hold, a position he carries on, or comes to exercise
and any warrant that it owns or comes to own within
a legal person having an activity in connection with the
inconsistencies referred to in article 60.
If necessary, the Instance of the protection of data of
a personal nature shall take all appropriate measures to
ensure the independence and impartiality of its members.
It puts in place a code of conduct for this purpose.

Art. 61 : the cessation of exercise in the course of the mandate
When in the course of the mandate of the president or a member of the
executive committee of the Instance of data protection
of personal character dies or ceases to perform its functions, it is replaced in the conditions
provided for by articles 57, 58 and 60 of this act.
The mandate of the successor so appointed shall be limited to the
remaining period.

29 October 2019

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO 15
Art. 62 : The oath of the members and staff of the Instance
of the protection of personal data
The members of the executive committee of the Instance of
the protection of personal data, prior to their
entry into service, shall provide to the Court of Appeal of Lomé
sitting in solemn hearing the oath which reads as
follows : "I solemnly swear to good, and fi is a faithful fulfil
my duties as a member of the Forum for the protection of
personal data, in full independence and
impartiality of how worthy and loyal and to keep the secrecy
of the deliberations ".
Other officers chosen by the Instance of the protection of
personal data lend solemn oath,
also before the court of first instance of Lomé in
these terms : "I swear that I will well and faithfully fulfill my
duties as an agent of the Instance of the protection of data
of a personal nature, in full independence and impartiality
and to keep the secrecy of the deliberations of, and information
of which I have knowledge."
Art. 63 : benefits
The members of the executive committee of the Instance of proprotection of personal data receive
allowances fi xed by a decree of the council of ministers.
Art. 64 : the self-management of the Instance of proprotection of personal data
The Instance of protection of personal data
shall be self-management.
The budget is prepared by the president and adopted by the Instance of protection of personal data.
The chairman of the executive committee of the Instance of protection of personal data is the organizer
of the budget.
Art. 65
: Resources in fi nancial Instance of proprotection of personal data
The resources in fi nancial allowing the Instance of proprotection of personal data to fulfil its
missions are composed of :
- a yearly budget allocation or grant of
the State, public bodies or international ;
- a fund from lending a part of the
revenue accrued by the payment of fines prononvanced by the Instance of the protection of personal data
of staff.
The Instance of the protection of data of a personal nature

may not receive a gift or grant to an individual, an
organization or a foreign State through
a structure of cooperation of the Republic of togo.
Art. 66 : searches conducted by the members of
the instance of the protection of personal data
The members of the Instance of the protection of data of
a personal nature as well as the service agents assermentés have access to it, in the conditions provided for in
articles 75 and following of the code of criminal procedure, for
the exercise of their missions, locations, local, speakers,
facilities, or facilities for the implementation
of a treatment of personal data, and which
are for professional use, to the exclusion of parts of
those assigned to the private home.
The prosecutor of the Republic, territorial jurisdiction
is informed beforehand.
Art. 67 : methods Of intervention of the president of the tricourt of first instance
In the event of opposition by the manager of the place, the visit
may take place with the permission of the President of the
Court of first instance in the jurisdiction in which are
located the premises to visit or the judge appointed by him.
The judge is seized at the request of the president of the body
protection of personal data. It shall act
by a reasoned order, in accordance with the provisions
of the articles 163 to 165 of the code of civil procedure.
Art. 68 : authority control
The members of the executive committee of the Instance of proprotection of personal data and the officers
mentioned in article 62 of this law may demander communication of all necessary documents to the acachievement of their mission, regardless of the support,
and make a copy of it. They can collect, on site or on
invitation, any and all information and justified cation helpful.
They can have access to computer programs and
data, ask for the transcription of any type of treatment in
the appropriate documents that can be used directly for
control purposes. They may be assisted by
experts chosen by the Instance of the protection of data of
a personal nature.
Art. 69
: The minutes of the vérifi cation and visits
It is developed jointly minutes of the verifi cation and visits carried out in application of articles 66,
67 and 68 of this act.

16

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

29 October 2019

Art. 70 : of the powers Of injunction
The Instance of the protection of data of a personal nature
may pronounce the following measures :
1) a warning against the person responsible for the processing
does not respect the obligations arising from this
act ;
2) a formal notice to stop the breaches
concerned within a period to be fi xed.
Art. 71 : The powers of sanction of the Instance of protection of personal data

In the case where the controller does
not the demand that was addressed to him, the Instance
of the protection of data of a personal nature may
pronounce against him, after hearing,
the following sanctions :
1) a temporary withdrawal of the authorization be granted for
a period of three (03) months, at the expiration of which, if
no corrective measures are not provided, the withdrawal
becomes défi nitif ;
2) a fine not to exceed one hundred million
(100 000 000) francs CFA.
The recovery of the penalties will be in accordance with the
legislation on the recovery of the debts of the State.
Art. 72 : emergency measures
In case of emergency, when the implementation of a processing
or use of personal data leads to a
violation of rights and freedoms, the Instance of the protection of
personal data, after the process contradictoire, may decide :

1) the suspension of the implementation of the treatment for a
maximum period of three (03) months ;
2) the lock of some personal data, personnel processed for a maximum period of three (03) months ;
3) the order of the compliance to the treatment with
the obligations arising from this act, which may be
accompanied, except in cases where the treatment is put in
place by the State, and to pay a fine the amount of which cannot
exceed five million (5 000 000) francs CFA per day ;
4) a call to order.
Art. 73 : provisional measures

When the implementation of a treatment or exploitation
of personal data is made without compliance with
the preliminary formalities, without prejudice to the penalties
criminal under this act, the Instance of the protection
of personal data shall take the measures
necessary to stop the treatment, including :
- how to be affixed, at the expense of the person responsible for the
treatment, by a bailiff, seals on all
device, equipment, or local who served or contributed to the
processing ;
- to proceed, in the presence of a bailiff, if
applicable, to the dismantling and removal of such devices
and equipment and provide care ;
- order that the person responsible for the treatment and at
its own expense, to render it inaccessible to the website or the module perputting the treatment.
Art. 74 : 's appeal against the decisions of the Instance of
the protection of personal data
Sanctions and decisions taken by the Instance of protection of personal data are subject
to appeal before the administrative chamber of the Court
supreme.
CHAPTER VI - CORRESPONDING TO THE PROTECTION
PERSONAL DATA
Art. 75 : the status Of the corresponding to the protection of
personal data

The corresponding to the protection of personal data
of staff is a person hold out the prospect of receiving a qualified cations
are required to carry out the missions to challenge as defined in article 76 of
this act. It may not be subject to any penalty in
the part of the employer of the fact of the accomplishment of its
missions. It may refer to the Instance of data protection
of personal character of the diffi culties faced by the child in
the exercise of its tasks.
The profi le of the corresponding to the protection of data of
personal character is specified by the Instance of the protection
of personal data.
Art. 76 : the mission of the corresponding to the protection
of personal data
The mission of the corresponding data protection
is :
1) to inform and advise the controller or
the processor and the employees who carry out the

29 October 2019

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

17

treatment on their obligations under
the present law, and other applicable laws concerning
protection of personal data ;
2) ensure compliance with this act and other legislation
applicable in the field of data protection and of the
internal rules of the controller or of the subcontractor in respect of the protection of personal data
, including the distribution of responsibilities,
awareness-raising and training of staff involved in
processing operations, and audits relating thereto ;
3) the provision of advice, on request, in relation to
the impact assessment on the protection of data
of a personal nature ;
4) cooperate with the Instance of the protection of data of
a personal nature ;
5) keep a list of the processing operations carried out immediately
accessible ;
6) do official, this point-of-contact for the Instance of protection of personal data on issues
relating to the treatment and to consult, where
appropriate, on any other subject.
The corresponding data protection shall be duly taken into
account, in carrying out its mission, the risk
associated with processing operations, taking account of the nature, scope, context and of the fi gures of the treatment.
Art. 77 : designation corresponding to the protection
of personal data
The designation of the corresponding by the head of the traitement is given to ea at the Instance of the protection of data
of a personal nature. It is, also, scope, if
applicable, to the knowledge of the representative bodies
of the staff.
Art. 78 : the revocation of the protection
of personal data
In the event of a member's failure to comply with its duties, the corres-

he is relieved of his duties on request, or
after consultation with, the Instance of the protection of data
of a personal nature.
CHAPTER VII PENAL PROVISIONS
Art. 79 : non-compliance with The formalities prior to
Anyone who performs or authorizes treatments
personal data without having complied with the
formalities prior to their implementation provided by
the legal and regulatory provisions, shall be punished by
imprisonment of one (01) year to five (05) years and
a fine of one million (1 000 000) to ten million (10 000
000) of CFA francs, or one of these two (02) sentences.
The author of the offence referred to in the preceding paragraph that acts
through negligence, default or address of caution, is
punished by imprisonment of one (01) year to three
(03) years and a fine of five hundred thousand (500 000) to
five million (5 000 000) of CFA francs, or one of these
two (02) sentences.
Art. 80 : The non-observance of measures of temporary withdrawal
of the authorisation granted
Anyone who performs or proceed with a treatment that
is the subject of the extent of temporary withdrawal of authorization,
shall be punished by imprisonment of one (01) year to
five (05) years and a fine of one million (1 000 000) to
ten million (10,000,000) CFA francs or one of these
two (02) sentences.
The author of the offence referred to in the preceding paragraph that acts
through negligence, default or address of caution, is
punished by imprisonment of one (01) year to three
(03) years and a fine of five hundred thousand (500 000) to
five million (5 000 000) of CFA francs, or one of these
two (02) sentences.
Art. 81
: Non-compliance with the standards simplifi ed or exowas earned established
Anyone who performs or the processing of
personal data in violation of the standards
simplifi ed or exemption established by the body responsible
for the control and protection of personal data,
personnel, shall be punished by a sentence of imprisonment of one
(01) year to three (03) years and a fine of five hundred thousand
(500 000) to five million (5 000 000) of CFA francs, or
one of these two (02) sentences.
The author of the offence referred to in the preceding paragraph that acts
through negligence, default or address of caution, is punished
by imprisonment of three (03) months to one (01)
year and a fine of one hundred thousand (100 000) to one million (1
000 000) of CFA francs, or one of these two (02) sentences.
Art. 82
: The unauthorized processing of data identifi cation of individuals
Any person shall, except in cases where the treatment has been
authorized under the conditions provided by this act,

18

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

29 October 2019

or is the processing of personal data
of staff including the data on which it
bears the registration number of the people in the directory
national identifi cation of natural persons, shall be punished
by imprisonment of one (01) year to five (05) years
and a fine of one million (1 000 000) to ten million (10
000 000) of CFA francs, or one of these two (02) sentences.
Art. 83 : non-compliance with The security measures

Anyone who performs or the processing of
personal data without having to implement the
safety requirements prescribed by this act, shall be punished
by imprisonment of one (01) year to five (05) years
and a fine of one million (1 000 000) to ten million (10
000 000) of CFA francs, or one of these two (02) sentences.
Art. 84 : The processing of fraudulent personal data
personal
Anyone collection of personal data
by fraudulent means or unlawful, shall be punished by a sentence
of imprisonment of one (01) year to five (05) years and a
fine of five million (5 000 000) to twenty million (20 000
000) of CFA francs, or one of these two (02) sentences.
Art. 85 : Of the non-respect of the right of opposition
Anyone who performs or the processing of
personal data relating to a person's
physical in violation of his right of opposition provided by
this act, when such treatment meets the fi ns of
exploration, including commercial, or when this
opposition is based on legitimate grounds, shall be punished
by imprisonment of one (01) year to five (05)
years and a fine of five million (5 000 000) to twenty
million (20 000 000) of CFA francs, or one of these
two (02) sentences.

Art. 86 : The unlawful processing of sensitive data
Whoever, except in cases provided for by law, makes or keeps
on medium, or computer memory, without the prior
express consent of the person concerned, of personal data
which, directly or indirectly, reveal the origin
of racial or ethnic origin, political opinions, philosophical
or religious, or trade union affiliations, or that
are related to health or sex life of it, is
punished with a penalty of imprisonment of one (01) year to five
(05) years and a fine of one million (1 000 000) to ten
million (10,000,000) CFA francs or one of these
two (02) sentences.

The provisions of the first paragraph of this article are
applicable to non-automated processing operations of data
of a personal nature, the implementation of which does
not in the exercise of activities or personal use only.
Art. 87 : The processing of data relating to offences,
convictions or security measures
Whoever, except in cases provided for by law, makes or keeps
on medium or computer memory data to charministry staff regarding offences, convictions
nations or the security measures, shall be punished by a sentence
of imprisonment of one (1) year to five (05) years and a
fine of one million (1 000 000) to ten million (10,000,000)
of CFA francs, or one of these two (02) sentences.
Art. 88
: The unlawful processing of data is to fi n the
research in the field of health

In the case of processing of personal data
for fi n research in the field of health,
shall be punished by imprisonment of one (01) year to five
(05) years and a fine of five million (5 000 000) to
twenty-five million (25 000 000) of CFA francs or one of
these two (02) sentences, those who carry out a treatment :
1) without having previously informed individually the
persons whose personal data are repicked or passed on their right to access, rectifi cation
and opposition, of the nature of the transmitted data and the
recipients of these, as well as the provisions taken
for their treatment, their conservation and protection ;
2) in spite of the opposition of the person concerned, or when it
is foreseen by the law, in the absence of informed consent
and express consent of the person, or if there is a person
deceased, despite the refusal by the latter of its living.

Art. 89 : 's non-compliance with the legal period of retention
Anyone who keeps the personal data
beyond the time required for the fi gures for which
they were collected or processed, except where such conservation
is carried out in the fi ns historical, statistical, cultural
, or scientific ques in the conditions provided for by law, is
punishable by a sentence of imprisonment of one (01) year to five
(05) years and a fine of one million (1 000 000) to ten
million (10,000,000) CFA francs or one of these
two (02) sentences.
Art. 90 : The processing of data that is retained beyond
the legal duration
Whoever, except in cases provided for by law, treaty, to fi ns

29 October 2019

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO 19

other than historical, statistical or scientific ques, of the
personal data stored beyond the
time necessary for the fi gures for which they were
collected or processed, shall be punished by a term of imprisonment of one (01) year to five (05) years and a fine of one
million (1 000 000) to ten million (10 000 000) francs
CFA francs or one of these two (02) sentences.
Art. 91
: The hijacking of fi nality
Anyone holding personal data
on the occasion of their registration, their classification,
their transmission, or any other form of human traffickingment, hijacks the information of their fi-nally, such as
challenge ned by the legislative and regulatory provisions,
or the decision of the Instance of the protection of data of
a personal nature allowing the automated process,
or through the statements prior to the implementation of
this treatment, shall be punished by a sentence of imprisonment of one
(01) year to five (05) years and a fine of five million (5
000 000) of twenty-five million (25 000 000) of CFA francs
or one of these two (02) sentences.
Art. 92 : Of the unauthorized disclosure of data
of a personal nature
Anyone who collects, at the time of recording,
classification, transmission or other
form of processing of the personal data
, the disclosure of which would have the effect of impairing the
account of the person concerned, or to the intimacy of his private life,
worn, without authorization of the interested party, these data, to the
knowledge of a third party who did not quality for the recesee, shall be punished by imprisonment of one (01) year
to five (05) years and a fine of one million (1 000 000)
to ten million (10,000,000) CFA francs or one of
these two (02) sentences.
When the disclosure provided in the preceding paragraph of the prethis article is committed by imprudence or negligence, the
responsible is punished with a sentence of imprisonment of six
(06) months to two (02) years and a fine of five hundred
thousand (500 000) to two million (2 000 000) of CFA francs
or one of these two (02) sentences.

Art. 93 : the barrier to the action of the Instance of the protection
of personal data
Shall be punished by imprisonment of six (06) months to
two (02) years and a fine of one million (1 000 000) to
ten million (10,000,000) CFA francs or one of these
two (02) penalties any person who obstructs the action of the Instance
in charge of the control and the protection of data of
a personal nature :
1) in opposition to the exercise of the tasks entrusted to esa to
its members or agents authorised pursuant to the
law on personal data ;
2) either refusing to communicate to its members or
agents authorised under the act on the data
of a personal nature, the information and documents
relevant to their mission, or by concealment of such documents
or information, or making them disappear ;
3) the communication of information that is not
consistent with the content of the recordings as he was at
the time the application was made, or who do
not have this content in a form that is directly accessible.
CHAPTER VIII - TRANSITIONAL PROVISIONS AND
FINAL
Art. 94 : The derogation of the declaration
As A transitional measure, the processing of data carried for
the account of the State, a public institution, a collectivities local or a legal person in private law managing
a public service and already created, are not subject to a
declaration to the Instance of the protection of data
of a personal nature, in the conditions laid down in article
6 of this law.
Art. 95 : The deadline for compliance of the treatment
in progress
As of the date of entry into force of this
act, all processing of data must meet the
requirements thereof, within the deadlines below :
1) two (02) years to the processing of data carried
for the account of the State, a public institution, a
local authority or a legal person in private law
managing a public service ;
2) one (01) year for traitements de données à caractère
personnel carried out for the account of persons other
than those subject to the provisions of the preceding paragraph.
Art. 96 : with the repeal Of the provisions to the contrary
Are repealed any previous provisions contrary
to this law.

20

OFFICIAL JOURNAL OF THE REPUBLIC OF TOGO

29 October 2019

Art. 97 : this law is enforced as the law of the State.
Done in Lomé, October 30, 2019
The President of the Republic
Faure Essozimna GNASSINGBE
The Prime minister
Selom Komi KLASSOU
____________
DECREE N° 2019-128 /PR of 18/09/19
on the appointment of the director of inspections
forest
THE PRESIDENT OF THE REPUBLIC,
On the proposal of the minister of the environment, developmentsustainable development and the protection of nature ;
Having regard to the constitution of 14 October 1992 ;
Having regard to decree no. 2012-004/PR of February 29, 2012, relating to the
responsibilities of the ministers of State and ministers ;
Having regard to decree no. 2012-006/PR of 07 march 2012 relating to
organization of the ministerial departments ;
Having regard to decree no. 2019-003/PR of 24 January 2019 concerning
appointment of the Prime minister ;

Having regard to decree no. 2019-004/PR of 24 January 2019 concerning
the composition of the Government, as amended by the decree
n° 2019-005/PR of 25 January 2019 ;
The council of ministers heard,
Hereby decrees :
Article premier : Mr. Essodina KONZAHOU,
n° mle 043599-H, engineer of the waters and forests, is appointed
director of inspections forestry to the ministry of the envienvironment, sustainable development and the protection
of nature.
Art. 2 : this decree repeals all provisions
earlier contrary to those of the present decree.
Art. 3 : the minister of The environment, development,
sustainability and the protection of nature is responsible for the execution
execution of this decree, which will be published in the Journal Offi sky
of the Republic of togo.

Done in Lomé, September 18, 2019
The President of the Republic
Faure Essozimna GNASSINGBE
The Prime minister
Selom Komi KLASSOU
The minister of the Environment, Development
sustainable development and the Protection of nature
Prof. David Wonou OLADOKOUN
DECREE N° 2019 - 129 /PR of 18/09/2019
on the appointment of the director of resources
forest
THE PRESIDENT OF THE REPUBLIC,
On the proposal of the minister of the environment, developmentsustainable development and the protection of nature,
Having regard to the constitution of 14 October 1992 ;

Having regard to decree no. 2012-004/PR of February 29, 2012, relating to the
responsibilities of the ministers of State and ministers ;
Having regard to decree no. 2012-006/PR of 07 march 2012 relating to
organization of the ministerial departments ;
Having regard to decree no. 2019-003/PR of 24 January 2019 concerning
appointment of the Prime minister ;
Having regard to decree no. 2019-004/PR of 24 January 2019 concerning
the composition of the Government, changed by decree n°
2019-005/PR of 25 January 2019 ;
The council of ministers heard,
Hereby decrees :
Article first : Madam Amah ATUTONU, n° mle
044035-M, geographer, regional director of the ministry
of the environment, of sustainable development and the
protection of the nature of the maritime region, is named
director of the forest resources.

Art. 2 : Is repealed, the decree n° 2014-148/PR of 02
July 2014 on the appointment of the director of the resource
forest.
Art. 3 : the minister of The environment, development,
sustainability and the protection of nature is responsible for
the execution of this decree, which will be published in the Journal
Offi sky of the Republic of togo.
Done in Lomé, September 18, 2019
The President of the Republic
Faure Essozimna GNASSINGBE
The Prime minister
Selom Komi KLASSOU
The minister of the Environment, Development
sustainable development and the Protection of nature
Prof. David Wonou OLADOKOUN

Imp. Editogo
Legal deposit no. 26b

