In July 2021, a SIM card registration and limitation of subscriptions per individual and network campaign was launched by the telecommunications regulatory authority ARCEP, supported by leading telecom operators Moov Africa Togo and TogoCom. The SIM registration requirements include a national identity card or passport and the collection of biometric and demographic data.

Togo has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

Togo has a telecommunications authority: Autorité de Régulation des Communications Électroniques et des Postes (ARCEP). However, it is reported that this entity is not fully independent.

Art. 28 of Law No. 2019-014 on the protection of personal data states that data can only be transferred abroad if the third country ensures an adequate level of privacy protection. Art. 29 permits a transfer of data provided that the transfer is one-off, not massive and that the person to whom the data relates has expressly consented to its transfer, or if the transfer is necessary under specific conditions. Moreover, according to Art. 30, the Data Protection Authority may authorise the transfer of data if the data controller provides sufficient guarantees with regard to the protection of privacy, fundamental rights and freedoms of the persons concerned and the exercise of the corresponding rights.

Art. 21 of Law No. 2019-014 prohibits the processing of sensitive data related to racial or ethnic origin, religious, philosophical, political, or trade union opinions or activities, sex life, health, social measures, prosecutions, or criminal and administrative sanctions (defined in Art. 4). Several exceptions to this prohibition are outlined in Art. 22. These exceptions include cases in which the data has been deliberately made public by the data subject, the data subject has provided explicit written consent in accordance with applicable legal provisions, the processing is necessary to protect the vital interests of the data subject or another person, particularly when the data subject is incapacitated, or the processing is required for the establishment, exercise, or defence of legal claims.
Processing is defined as any operation or set of operations provided for in Art. 2, whether or not carried out using automated processes and applied to data, such as collection, exploitation, recording, organisation, conservation, adaptation, modification, extraction, storage, copying, consultation, use, communication by transmission, dissemination or otherwise making available, alignment or combination, as well as the blocking, encryption, erasure or destruction of personal data (Art. 4).

Togo has not joined any free trade agreement committing to open transfers of cross-border data flows.

The Law No. 2019-014 on the protection of personal data provides a comprehensive regime of data protection in Togo. Law No. 2019-014 governs the collection, processing, transmission, storage, and utilisation of personal data in the country. This legislation mandates the establishment of the Togolese Data Protection Authority (IPDCP) and stipulates the appointment of data protection officers.

According to Art. 95 of Togo’s 2012 Electronic Communication Law, cryptology services providers are required to keep for one year content and data allowing the identification of anyone who has used their services and provide the technical means that enable the identification of those users.

Art. 63 of Law No. 2017-07 of June 22, 2017 on Electronic Transactions requires service providers to hold and retain, at least for a period of one year, data of such a nature as to allow the identification of anyone who has contributed to the creation of the content or any of the content of the services they provide.

Chapter VI of Law No. 2019-014 on the protection of personal data provides that data controllers are required to appoint a personal data protection correspondent.

According to Art. 95 of Togo’s 2012 Electronic Communication Law, cryptology services providers are required to keep for one year content and data allowing the identification of anyone who has used their services and providing the technical means that enable the identification of those users. The service providers are required to avail of this data, on request, to the investigating judge, the Prime Minister, the Minister for Economy and Finance, the Minister of Defence, the Minister of Justice, and the Minister of Security.

Law No. 2017-07 of June 22, 2017 on Electronic Transactions establishes a safe harbour regime for intermediaries for copyright infringements. According to Arts. 55 and 56 of the law, electronic communication operators are subject to civil or criminal liability for the content stored or transmitted on their networks only in cases where:
- they are at the origin of the disputed request for transmission;
- they select the receipt of the transmission;
- they select or modify the content being transmitted;
- they did not promptly remove or block access to the illegal content upon becoming aware of it or upon receiving a served judicial order.

It is reported that there is an obligation for passive infrastructure sharing in Togo to deliver telecom services to end users. It is practised in both the mobile and fixed sectors based on commercial agreements.

The incumbent telecommunications company in Togo, TogoCom, initially fully owned by the government, underwent partial privatisation under Decree No. 2019-142/PR. This decree permitted up to 51% of the company’s shares to be transferred to the private sector, resulting in a 51% acquisition by Agou Holding consortium, made up of the Madagascan conglomerate Axian (majority) and the capital-investor Emerging Capital Partners (ECP). Although no legal framework restricts foreign capital in the telecommunications sector, the Togolese Government maintains a 49% stake.

TogoCom, the incumbent telecommunications company in Togo, has been opened to the private sector, but the State still holds 49% of the shares. TogoCom is the de facto monopoly provider of fibre backbone connectivity to ISPs and other content and data providers.