Burkina Faso Law 037-2026/ALP compliance and requirements, so your data handling holds up when someone asks.

What it is

What is Burkina Faso's Law 037-2026/ALP and what is it used for?

Law No. 037-2026/ALP on the Protection of Personal Data is Burkina Faso's personal data protection law. It covers automated and non-automated processing by controllers established in Burkina Faso, by controllers or processors outside it that process from national territory (transit data excluded), and by those who process data of people located in Burkina Faso when offering goods or services, monitoring behaviour, profiling, geolocating or running a digital platform accessible there; a representative may have to be designated. Consent is the default basis, with listed exceptions.

The Autorité de régulation de la communication et du traitement des données à caractère personnel (ARCOD) is the body named by the organic law; the Commission de l'informatique et des libertés (CIL) stays competent for pending files until the ARCOD is effectively set up. The practical test: for any personal data you hold, could you show its purpose and basis, who was told, how it is protected and where it goes?

Current law. Law No. 037-2026/ALP of 3 August 2026 on the protection of individuals with regard to the processing of personal data, promulgated by Décret n° 2026-1034/PF of 22 September 2026 (decree and law posted on the legislation page of the CIL); the law repeals Loi n° 001-2021/AN of 30 March 2021. Confirm current wording and the authority's guidance with your legal advisers.

Who it is for

Who needs to comply with Burkina Faso's Law 037-2026/ALP?

The Law reaches organisations of every size that handle personal data in Burkina Faso. Organisations usually come to Sterling for a structured programme from one of four directions:

• Any company processing customer, employee or supplier data in Burkina Faso. The law covers controllers established in the country and those outside it that process from national territory or target people located there.
• Banks, payment firms and telecom operators. They handle national identification numbers and transaction data, and processing of national identification numbers needs the authority's authorisation.
• Health care and pharmaceutical operators. Identifiable health data is hosted on national territory unless the authority derogates, and health research needs the authority's authorisation.
• Employers using biometric access or attendance systems. Private-sector biometric processing needs authorisation and an impact assessment, and the CIL has published a deliberation on biometric access control at work.

The aim is handling of personal information that you control and can evidence. Compliance depends on how the rules are applied every day, not on a policy document alone.

Requirements

What are the main Burkina Faso Law 037-2026/ALP requirements?

Strip away the vocabulary and Burkina Faso's personal data law requires a business to comply in six areas of personal data handling. The list below puts each one in business terms; the Law and the regulator's guidance give the full wording and exceptions.

• Check scope and appoint a representative: the law reaches processing in Burkina Faso and processing abroad aimed at people located there; some controllers established outside the country must designate a representative.
• Collect on a lawful basis, usually consent: data is gathered fairly for stated purposes, on consent unless a listed ground applies, and kept accurate, secure and no longer than needed.
• Honour individual rights and explain automated criteria: people can access, object, correct, erase and port their data, and learn the criteria when artificial intelligence processes it.
• Secure data, report breaches, assess impact: controllers keep a register, build protection in by design, notify the authority of a breach within forty-eight hours and assess impact for high-risk processing.
• Obtain the authority's opinion or authorisation: processing is declared, or needs an opinion or prior authorisation, for biometric, genetic, interconnection, identification-number, predictive AI decision-aid and transfer cases.
• Check processors, transfers abroad and sanctions: processors act under a written agreement, transfers need adequate protection plus safeguards, and the authority can order a stop, lock data, fine or withdraw authorisations.

Compliance route

How do you achieve Burkina Faso Law 037-2026/ALP compliance?

There is no certificate at the end of this route. Compliance is something your organisation demonstrates, to the ARCOD if a complaint or incident arises, and to customers who ask. Sterling helps you build and run the programme; interpretation of the law in contested cases remains with your legal advisers and, ultimately, the regulator and the courts.

1. 01
   Map the personal information you handle.Customers, staff, users and suppliers: what is collected, for which purpose, on which basis, where it is stored, who processes it for you and whether it leaves Burkina Faso.
2. 02
   Gap analysis: compare current practice with the Law.Each area of the Law reviewed against what actually happens, with actions, owners and dates agreed.
3. 03
   Put the controls and routines in place.Complete the formalities the Law asks for, rewrite notices and consent wording, put security measures and processor contracts in place, name who is responsible and agree a breach procedure.
4. 04
   Test the programme and review the results.Internal review of samples, a simulated incident or data-subject request, and a management review that closes findings with evidence.
5. 05
   Operate, demonstrate and keep it current.Answer requests, record incidents and report them as the Law requires, keep formalities current, review transfers, refresh training and follow the ARCOD's guidance as it is issued.

Check the route before you sign. The Law creates no certificate of compliance, so treat any offer of a "Burkina Faso Law 037-2026/ALP certificate" with suspicion. If a customer wants independent assurance, ISO/IEC 27701 or ISO/IEC 27001 is certifiable by an accredited certification body; confirm the body's accreditation scope directly with the accreditation body concerned.

Cost

How much does Burkina Faso Law 037-2026/ALP compliance cost?

The cost of a Burkina Faso Law 037-2026/ALP programme is driven by how much personal information you hold, how many systems and suppliers touch it, and how much already works. Your proposal shows each component, with what is included and what remains for your legal advisers.

Timeline

How long does Burkina Faso Law 037-2026/ALP compliance take?

Timing depends on how scattered your personal information is, how quickly system owners respond and how much has to change. Your proposal sets out the phases for your scope, long enough to map the information, fix the gaps and show that requests and incidents are handled the way the procedures say.

If a customer or contract has set a date, tell us at the outset and we will say plainly what can be in place by then and what should follow.

Your engagement

What your Burkina Faso Law 037-2026/ALP engagement includes

Your scope covers the full programme, from the information map to evidence that runs. Sterling does not certify, attest or validate compliance with the Law, and the Law creates no certificate of compliance; the ARCOD supervises it, and we work alongside your legal advisers.

• Information map, gap analysis and plan

  Sources, systems, suppliers and overseas flows, with actions and owners agreed.

• Policies, notices and procedures

  Notices, consent wording, request, security and breach procedures, processor contract terms and transfer documents, drafted from Sterling's own templates with your teams.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Sample testing, an incident exercise and findings closed with evidence.

• Formalities support

  Help preparing the formalities the Law asks for and the responsible person's role, with findings closed with evidence.

Sterling OS™ sets how we deliver. Design™ is guided support, where your team builds the programme with our consultants' direction; Drive™ is managed support, where our consultants do most of the work with your input. You choose one of the two, not both in sequence. Once the programme is operating, Sustain™ keeps reviews, training and updates on schedule, and Automate™ is Effivity, where the records live.

The Autorité de régulation de la communication et du traitement des données à caractère personnel (ARCOD) is the body named by the organic law; the Commission de l'informatique et des libertés (CIL) stays competent for pending files until the ARCOD is effectively set up.

Often combined with

Standards organisations pair with Law 037-2026/ALP (Burkina Faso)

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.