Francophone West Africa data protection

Practical guidance, not legal advice. Procedures vary by country: confirm with your national authority.

If your school operates in a francophone West African country, you likely have your own data-protection law and authority. The key point: several of these countries require prior authorisation before personal data leaves the country. Because iEasySR stores data abroad (in the United Kingdom), this cross-border transfer is a condition to clear before or as you go live, not after. Your school is the data controller; iEasySR is your cross-border processor.

Regional framework

The ECOWAS Supplementary Act A/SA.1/01/10 on Personal Data Protection (2010) sets a common baseline. Most member states have an implementing law and an independent authority.

Authorities and laws by country

• Senegal: Commission de protection des données personnelles (CDP), Law No. 2008-12.
• Cote d'Ivoire: protection authority (ARTCI), Law No. 2013-450.
• Benin: Autorite de Protection des Donnees a caractere Personnel (APDP), Digital Code (Law 2017-20).
• Togo: Instance de Protection des Donnees a caractere Personnel (IPDCP), Law No. 2019-014.
• Burkina Faso: Commission de l'Informatique et des Libertes (CIL), Law No. 010-2004.
• Others (Mali, Niger, Guinea...): comparable regimes exist; check with the relevant authority.

The key difference: prior authorisation

Unlike a simple registration model, several of these regimes require you to obtain the authority's authorisation (or make a declaration and receive its approval) before transferring data out of the country. Treat it as a condition precedent: build the step into your go-live plan.

What to do

• Declare or register your processing with your national authority.
• Apply for cross-border transfer authorisation, disclosing iEasySR as your processor and the destination (United Kingdom) and sub-processors.
• Appoint a data-protection officer or correspondent where the law requires.
• Put appropriate safeguards in place (our Data Processing Agreement) and, where required, obtain data-subject consent.
• Renew as your law requires.

Our disclosures (to support your application)

• Processor: iEasySR Pty Ltd, a company registered in Australia.
• Role: cross-border processor providing cloud school-management software.
• Hosting: primary storage in the United Kingdom (Neon, London); limited sub-processing in the United States. See Annex C of the Data Processing Agreement.
• Security: measures in Annex B of our Agreement.
• Agreement: a signed Data Processing Agreement can be provided on request.

Documents to attach

• Your national authority's form.
• Our Data Processing Agreement.
• Optional: our Privacy Policy and the parent notice.

Questions: support@ieasysr.com. Confirm the exact procedure, forms and fees with your authority and a qualified local adviser.