The is no country-wide system of registration in the Republic of Benin. However, the law imposes an obligation of notification and requires the controller to keep a register of processing activities carried out under its responsibility.

Pursuant to Article 405 of the Digital Code, Automated or non-automated processing carried out by public or private bodies and involving personal data must, prior to their implementation, be the subject of a prior declaration to the Authority or be entered in a register kept by the person designated for that purpose by the controller.

All processing of personal data is subject to a reporting obligation to the Authority, except for the exemptions provided for in Book V of the Digital Code (see Articles 408, 410, 411, and 417 of the Digital Code).

In terms of Article 435 of the Digital Code, each controller and, where applicable, the controller's representative shall keep a register of the processing activities carried out under their responsibility.

This register shall include all of the following information:

• the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;
• the purposes of the processing;
• a description of the categories of data subjects and categories of personal data;
• the categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organizations;
• where applicable, transfers of personal data to a third country or to an international organization, including the identification of that third country or international organization;
• the time limits for the deletion of the different categories of data;
• a general description of technical and organizational security measures.

Each processor and, where applicable, the processor's representative of the processor shall also maintain a record of all categories of processing activities performed on behalf of the controller including:

• the name and contact details of the sub-processor(s) and of each controller on whose behalf the processor is acting and, where applicable, the names and contact details of the controller's or processor's representative and of the data protection officer;
• the categories of processing carried out on behalf of each controller;
• where applicable, transfers of personal data to a third country or to an international organization, including the identification of that third country or international organization and, in the case of transfers, the documents attesting to the existence of appropriate safeguards;
• a general description of the technical and organizational security measures.

The above-mentioned records must be in written form, including electronic form.

The controller or processor and, if applicable, their representative shall make the register available to the Authority upon request.

The obligation to keep a register does not apply to small and medium-sized enterprises except in the following cases:

• if the processing they carry out is likely to involve a risk to the rights and freedoms of the data subjects;
• if it is not occasional or if it concerns in particular the special categories of data referred to in article 394 paragraph 1 of the numerical code, or personal data relating to criminal convictions and offences.