# Data protection for KYC in MENA and Africa | Konnect ID

> How to handle ID images, selfies and biometric data under the privacy laws of Tunisia, Morocco, Algeria, Egypt and West Africa, with practical controls.

Source: https://id.konnect.network/compliance/data-protection-identity-verification · Language: en · Also in fr: https://id.konnect.network/fr/compliance/data-protection-identity-verification · ar: https://id.konnect.network/ar/compliance/data-protection-identity-verification

## Identity data, handled with care.

A verification collects some of the most sensitive data a company can hold: an identity document, a face, sometimes a biometric template. Every market in the region has a law on it. This guide lists them and the controls that keep you on the right side of each.

## The laws

- Tunisia: Organic Law 2004-63, supervised by the INPDP. A bill to replace it is before parliament.
- Morocco: Law 09-08, supervised by the CNDP.
- Algeria: Law 18-07, supervised by the ANPDP.
- Egypt: Law 151 of 2020, with executive regulations issued under Ministerial Decision 816 of 2025.
- Senegal: Law 2008-12, supervised by the CDP. Côte d'Ivoire: Law 2013-450, supervised by ARTCI.

## What they have in common

- A lawful basis, often the legal KYC obligation, and clear information to the customer.
- Collect only what the purpose needs, and keep it only as long as required.
- Extra care for biometric and identity data.
- Authorisation or safeguards before transferring data abroad.
- Security measures, and in several laws, declarations or authorisations with the authority.

## Practical controls

- Show a consent and information screen before capture, and keep the record.
- Set retention per flow, and delete images you no longer need.
- Avoid storing extracted data you do not use.
- Restrict who can open a case, and log every access and decision.
- Choose where data lives: a cloud region you approve, or your own servers.

## How Konnect ID helps

The flow opens by telling the customer what is collected and why. Sensitive fields are encrypted at rest. With persistData=false, extracted data is held in memory only and removed after your first fetch. Role-based access and an audit log cover the review desk. The self-hosted edition runs on your infrastructure, so customer records stay in your database and storage, in your country.

## FAQ

### Can identity data stay in our country?

Yes, with the self-hosted edition on your own servers or private cloud.

### Can Konnect ID avoid storing extracted data?

Yes. With persistData=false, extracted data is kept in memory only and removed after the first fetch.

## Sources

- [Tunisia's data protection bill (Global Law Experts)](https://globallawexperts.com/tunisia-moves-replace-its-twentyyearold-data/)
- [Egypt PDPL executive regulations (CMS)](https://cms.law/en/are/legal-updates/egypt-s-pdpl-executive-regulations-issued-one-year-compliance-countdown-begins)

_Last reviewed on 2026-10-27. This page explains the rules in plain words and is not legal advice._

---

Konnect ID · [Book a demo](https://id.konnect.network/#demo) · contact@konnect.network