Personal data: CDP says it processed 195 cases in the second quarter of 2026

The Personal Data Protection Commission (CDP) has presented its report for the second quarter of 2026, marked by the processing of 195 cases. The independent administrative authority says it received 41 authorisation requests and granted 39 of them.

The authorisations notably concerned web platforms, which accounted for 15, as well as customer databases, with six applications approved. Projects cited include the artificial intelligence-based financial analysis platform “SAMA KOTAR”, a medical study on HIV among children and adolescents, and video surveillance systems.

One refusal over four shortcomings

The CDP rejected an application submitted by Actuarial AI Consulting for the “Arma Care” website. According to the authority, the application did not clearly define the categories of people concerned, did not specify the data retention period and did not provide for consent to be obtained before a transfer to a third country. It also noted that unauthorised individuals could access the data.

Eight complaints and five inspections

Eight complaints were registered between April and June. They notably concerned personal data breaches, identity theft, harassment and unsolicited commercial marketing. One complaint targets Sonatel over unsolicited commercial marketing, while another concerns X over data breaches and harassment.

A report against APRIL OIL, concerning the allegedly non-compliant installation of video surveillance in offices, is being processed. The CDP also says it conducted five inspection missions during the quarter.

During these checks, the authority cited recurring shortcomings including the absence of procedures allowing people to exercise their rights of access or deletion, data collection without prior authorisation, cameras installed in meeting rooms, and the lack of confidentiality agreements with subcontractors.