The Senegalese data protection law (LAW N 2008-12) extends its applicability to data processing activities that utilize equipment located within Senegal, regardless of whether the data controller is established in the country. This provision is found in Article 2(4) of the law.

The law applies to "Any implemented treatment by a person in charge, established or not on the Senegalese territory, which resorts to ways of treatment situated on the Senegalese territory". This means that if a data controller, whether based in Senegal or not, uses any means of data processing that are physically located in Senegal, they fall under the jurisdiction of this law.

However, there is an important exception to this rule. The law does not apply if the equipment in Senegal is "used only for purposes of transit on this territory". This exception likely covers scenarios where data merely passes through equipment in Senegal without being processed or stored there.

An additional requirement is imposed on non-Senegalese data controllers who fall under this provision. They "have to appoint a representative established on the Senegalese territory". This requirement ensures that there is a point of contact within Senegal for regulatory and legal matters related to the data processing activities.

Implications

This provision has significant implications for businesses operating internationally:

1. Global companies processing data of Senegalese individuals must carefully consider the location of their data processing equipment. If any part of their data processing infrastructure is in Senegal, they may be subject to Senegalese data protection law.
2. Companies using cloud services or data centers in Senegal for processing personal data will likely fall under this law's jurisdiction, even if they have no other presence in the country.
3. Businesses that route data through Senegal without processing it there may be exempt, but they should ensure their activities truly qualify as mere "transit".
4. Non-Senegalese companies using equipment in Senegal for data processing must appoint a local representative, which may involve additional costs and administrative burdens.
5. This provision effectively extends the reach of Senegalese data protection law beyond its borders, potentially capturing a wide range of international data processing activities that have a connection to Senegal through the use of local equipment.