Obligation to designate a CPDCP

• According to Article 5 of Law 2013-450, the processing of personal data is subject to a prior declaration to the ARTCI. However, this obligation to declare may be waived if the controller designates a CPDCP, except in the case of the transfer of personal data to a third country. The designation of a CPDCP is therefore a choice that exempts the declaration, and not a legal obligation (Article 6 of the aforementioned law).
• When the data controller opts to designate a CPDCP, it must notify the ARTCI of this designation (Article 6 of the Order on the correspondent's profile).
• The CPDCP is responsible for independently ensuring compliance with the legal obligations relating to the protection of personal data.

Qualifications required for the CPDCP

• Law no. 2013-450 stipulates that the CPDCP must have the necessary qualifications to carry out his or her duties.
• Order No. 511/MPTIC/CAB of 11 November 2014 specifies the profile required for the CPDCP, which differs depending on whether it is a natural or legal person:
  • For natural persons:
    • Be of Ivorian nationality (implied)
    • Have at least a BAC+4 level in the fields of legal sciences, computer science or telecommunications/ICT networks, or an equivalent diploma
    • At least two years' professional experience in these fields
    • Proven competence in personal data protection
    • Have a good knowledge of database management and operating systems, data storage methods and information systems security policies
    • Mastery of office automation tools and the internet
    • Excellent interpersonal and organisational skills
    • Not to have been the subject of a final criminal conviction or a ban on exercising an activity, handed down by an Ivorian or foreign court, or of a sanction handed down by ARTCI
  • For legal entities:
    • Be a legal person under Ivorian law
    • Prove that they are tax-compliant and that they are registered with social security institutions
    • Have been active for at least five years in the fields of legal sciences, information technology or telecommunications/ICT networks, and provide proof of this
    • Have insurance covering professional risks relating to the protection of personal data
    • Have staff with at least the profile of a CPDCP, natural person

It is important to note that the controller cannot be designated as a CPDCP.

A natural person CPDCP can only be designated by a single controller and carry out his duties only with the latter. On the other hand, a legal entity may be appointed by several data controllers.

Duties of the CPDCP

The CPDCP is responsible for ensuring, in an independent manner, compliance with the legal obligations relating to the protection of personal data.

Its main missions, defined by Law No. 2013-450, and specified by Order No. 511/MPTIC/CAB include:

• Maintaining the list of data processing carried out
• Keeping a copy of the codes and passwords required to access files relating to processing
• Provide access to data to any data subject who requests it in order to exercise their rights
• To ensure compliance with legislation on the protection of personal data
• To inform and advise the data controller and employees on legal obligations in relation to data protection
• Notify the data controller of any breaches of legislation observed
• Notify the ARTCI of uncorrected breaches within three months of reporting to the controller
• Notify the ARTCI of any difficulties encountered in carrying out its duties

Other important elements

• The appointment of the CPDCP must be notified to the ARTCI.
• The ARTCI has 30 days to object to the designation if the CPDCP does not meet the required profile.
• The CPDCP may not be sanctioned by his employer for the performance of his duties.
• The controller may replace the CPDCP for a legitimate reason, after informing the CPDCP and giving him/her the opportunity to present his/her observations. The replacement must also be notified to the ARTCI.
• Decree No. 2015-79 specifies that applications to file a declaration and authorisation for the processing of personal data must be submitted by a natural person resident in Côte d'Ivoire or a legal person under Ivorian law.