The provisions under LAW N 2008-12 Art.2(3) and (4) outline the scope of application of the law, including entities established in Senegal and those that use means situated in Senegal for data processing, unless it is solely for transit purposes.

The use of the phrases "Any implemented treatment by a person in charge such as defined in the article 4.14 of the present law on the Senegalese territory or in any place where the Senegalese law applies" and "Any implemented treatment by a person in charge, established or not on the Senegalese territory, which resorts to ways of treatment situated on the Senegalese territory" emphasizes the territorial aspect of the law's applicability, focusing on the location of data processing activities and the establishment of entities in Senegal.

Implications

For businesses, this means that any entity established in Senegal or using means situated in Senegal for data processing activities must comply with the data protection law. This includes adhering to the principles of lawful processing, ensuring data subjects' rights are respected, and implementing appropriate security measures to protect personal data.

Examples of cases where the law applies due to this factor include:

• A company headquartered in Senegal processing customer data.
• A foreign entity using data centers or third-party data processors located in Senegal.

Conversely, the law does not apply to entities that process data outside Senegal unless they use means situated in Senegal for purposes other than transit.