Madagascar Law 2014-038
Law No. 2014-038 of December 16, 2014 Relating to the Protection of Personal Data
Key Facts
Overview
Madagascar's Law 2014-038 establishes a comprehensive data protection framework enforced by the Commission Malagasy de l'Informatique et des Libertes (CMIL). Although the law was enacted in December 2014, the CMIL was only established in December 2023 after a nine-year delay. The law features one of Africa's highest penalty caps at 5% of pre-tax turnover, alongside criminal penalties including imprisonment for severe breaches. Prior notification to the CMIL is required before any data processing.
What This Means for Your Website
If your website processes personal data of individuals in Madagascar, you must notify the CMIL before processing, obtain consent or establish another valid legal basis, and implement data security safeguards. Cross-border data transfers are restricted to countries with adequate protection unless you obtain CMIL approval or data subject consent.
Key Requirements
Organizations must notify the CMIL before processing personal data. Consent or a valid legal basis is required. Data security safeguards must prevent unauthorized access. Cross-border transfers require adequate protection in the recipient country or CMIL approval. Data subjects have rights of access, rectification, and deletion. Data minimization and purpose limitation principles apply.
How ConsentStack Handles This
ConsentStack provides a consent management solution for Madagascar's Law 2014-038. It delivers a configurable consent banner, records consent decisions with timestamps for CMIL notification compliance, supports data subject rights workflows, and maintains audit trails. ConsentStack helps demonstrate lawful processing to the newly operational CMIL.
Penalties
Up to 5% of pre-tax turnover; fines MGA 200,000-10,000,000 for minor infractions; criminal penalties including imprisonment for severe breaches
Key Requirements
- Consent or valid legal basis required for processing personal data
- Data security safeguards mandatory to prevent unauthorized access
- Cross-border transfers only to countries with adequate protection or with CMIL approval
- Data subjects have rights of access, rectification, and deletion
- Prior notification to CMIL required before processing
- Data minimization and purpose limitation principles
Notable Provisions
- CMIL was established in December 2023 — a 9-year delay after the law's enactment
- 5% turnover penalty cap is among the highest in Africa
- Law was promulgated January 2015 but published in Official Gazette June 2015
Other Sub-Saharan Africa Regulations
Frequently Asked Questions
Is Madagascar's data protection law actively enforced?
The CMIL was only established in December 2023 after a 9-year delay, so enforcement is in early stages but now operational.
What are the penalties under Madagascar's Law 2014-038?
Penalties include up to 5% of pre-tax turnover, fines of MGA 200,000-10,000,000 for minor infractions, and criminal penalties including imprisonment for severe breaches.
Do I need to notify the CMIL before processing data?
Yes, prior notification to the CMIL is required before any personal data processing begins.
Can I transfer data out of Madagascar?
Cross-border transfers are only permitted to countries with adequate data protection, or with appropriate safeguards, explicit consent, or CMIL approval.
Stay compliant with Madagascar Law 2014-038
ConsentStack helps you implement Opt-in consent for Republic of Madagascar automatically.