The laws
- Tunisia: Organic Law 2004-63, supervised by the INPDP. A bill to replace it is before parliament.
- Morocco: Law 09-08, supervised by the CNDP.
- Algeria: Law 18-07, supervised by the ANPDP.
- Egypt: Law 151 of 2020, with executive regulations issued under Ministerial Decision 816 of 2025.
- Senegal: Law 2008-12, supervised by the CDP. Côte d'Ivoire: Law 2013-450, supervised by ARTCI.
What they have in common
- A lawful basis, often the legal KYC obligation, and clear information to the customer.
- Collect only what the purpose needs, and keep it only as long as required.
- Extra care for biometric and identity data.
- Authorisation or safeguards before transferring data abroad.
- Security measures, and in several laws, declarations or authorisations with the authority.
Practical controls
- Show a consent and information screen before capture, and keep the record.
- Set retention per flow, and delete images you no longer need.
- Avoid storing extracted data you do not use.
- Restrict who can open a case, and log every access and decision.
- Choose where data lives: a cloud region you approve, or your own servers.
How Konnect ID helps
The flow opens by telling the customer what is collected and why. Sensitive fields are encrypted at rest. With persistData=false, extracted data is held in memory only and removed after your first fetch. Role-based access and an audit log cover the review desk. The self-hosted edition runs on your infrastructure, so customer records stay in your database and storage, in your country.