The framework
Senegal's framework rests on Law 2008-12 on Personal Data Protection, with the CDP as the supervisory authority.
That puts Senegal in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Law 2008-12 on Personal Data Protection
A pioneer of the Francophone African model (2008) with an active commission; a modernization bill to reach GDPR grade has been in preparation.
Marketing and advertising
Consent-first with declaration and authorization duties. That single sentence decides most channel plans here.
Cross-border transfers
Transfers abroad require authorization from the CDP. Whatever the local mechanism, EU-origin data carries the GDPR's transfer chapter with it into this market.
Enforcement and penalties
The law provides for fines and criminal penalties. Read the ceiling together with the authority's track record, which prices the risk.