Status
Adopted
Consent model
Opt-in
Primary law
Law 2014-038 on Personal Data Protection
Year
2014
Authority
Commission (CMIL) provided by law; operationalization has lagged
Marketing consent
Consent-first on paper.
Transfers
The law ties transfers abroad to authorization by the data protection authority.
Penalties
The law provides for fines and criminal penalties.
The framework
Law 2014-038 on Personal Data Protection is on the books in Madagascar without yet being fully enforceable, a gap between enactment and operation that defines the current compliance picture.
That puts Madagascar in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Law 2014-038 on Personal Data Protection
2014 · Adopted
The 2014 law's commission took nearly a decade to begin materializing, so practical enforcement remains thin.
Marketing and advertising
Consent-first on paper. In practice that means consent before tracking or marketing outreach, documented well enough to show a regulator.
Cross-border transfers
The law ties transfers abroad to authorization by the data protection authority.
Enforcement and penalties
The law provides for fines and criminal penalties.
Cite this page: "Madagascar Data Privacy Laws." Digital Privacy Regulations, September 28, 2026, https://digitalprivacyregs.com/madagascar.html. Accessed [date].