Madagascar Law No. 2014-038 on Protection of Personal Data

National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.


Short name	MG PDPL
Region	Middle East & Africa
Country or scope	Madagascar
Sector	Privacy
In your workspace	Off until you switch it on in Compliance › Manage.

How Safeguard covers MG PDPL

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`MG-PDPL-SEC` Security and Confidentiality of Processing	Controllers must take all necessary precautions to preserve the security of personal data and prevent its alteration, damage or access by unauthorised third parties, evidenced by integrity hashes on processing components (Law No. 2014-038, security obligations)	Scan
`MG-PDPL-DECL` Declaration of Processing Systems	Automated processing of personal data is subject to declaration or authorisation formalities, which presupposes an inventory of the software systems carrying out the processing (Law No. 2014-038, prior-formalities regime)	Scan
`MG-PDPL-PROC` Subcontracted Processing Guarantees	Processing carried out on behalf of a controller must offer sufficient security guarantees under contract, so third-party software components must have named suppliers (Law No. 2014-038, subcontracting provisions)	Scan
`MG-PDPL-ID` Identifiable Components	Controlling access to processing systems and investigating unauthorised access requires their components to be uniquely identifiable (Law No. 2014-038, confidentiality and access-control duties)	Scan
`MG-PDPL-DOC` Traceable Documentation	Cooperation with the supervisory commission requires software records to be identifiable documents with a creation timestamp (Law No. 2014-038, supervisory cooperation duties)	Scan

All 22 from the standard set, adapted to MG PDPL.