Frameworks
Local requirements. One clear framework.
Explore the data protection laws hlola maps for your markets, and keep each country's obligations connected to one privacy programme.
7 countries in hlola
Browse frameworks
Explore frameworks.
10 frameworks shown
- West Africa
Ghana
Available
Data Protection Act, 2012 (Act 843)
11 controls an inspector checks, with tasks and evidence guidance.
Explore framework - East Africa
Uganda
Available
Data Protection and Privacy Act, 2019
13 controls an inspector checks, with tasks and evidence guidance.
Explore framework - East Africa
Kenya
Available
Kenya Data Protection Act, 2019
15 controls an inspector checks, with tasks and evidence guidance.
Explore framework - East Africa
Rwanda
Available
Law No 058/2021 relating to the protection of personal data and privacy
14 controls an inspector checks, with tasks and evidence guidance.
Explore framework - West Africa
Nigeria
Available
Nigeria Data Protection Act, 2023
14 controls an inspector checks, with tasks and evidence guidance.
Explore framework - East Africa
Tanzania
Available
Personal Data Protection Act, 2022
12 controls an inspector checks, with tasks and evidence guidance.
Explore framework - Southern Africa
South Africa
Available
Protection of Personal Information Act, 2013
18 controls an inspector checks, with tasks and evidence guidance.
Explore framework - EUInternational
European Union
Available
General Data Protection Regulation
11 controls an inspector checks, with tasks and evidence guidance.
Explore framework - Southern Africa
Botswana
In preparation
Data Protection Act, 2018
Being mapped into controls and reviewed by counsel. Visible here for planning.
Coming to hlola - Southern Africa
Zambia
In preparation
Data Protection Act, 2021
Being mapped into controls and reviewed by counsel. Visible here for planning.
Coming to hlola
Entries are maintained from the same law library that runs inside hlola and are pending review by counsel. Treat them as a starting point, not legal advice.
The clocks
Deadlines that differ by country.
Breach notices are counted from when the organisation becomes aware; rights requests from when they arrive. hlola runs each on its own country's clock.
| Country | Regulator | Breach notice | Rights requests |
|---|---|---|---|
| Ghana | Data Protection Commission (Ghana) | 72 hours | 30 days |
| Uganda | Personal Data Protection Office (Uganda) | 72 hours | 30 days |
| Kenya | Office of the Data Protection Commissioner | 72 hours | 7 days |
| Rwanda | National Cyber Security Authority (Rwanda) | 48 hours | 30 days |
| Nigeria | Nigeria Data Protection Commission | 72 hours | 30 days |
| Tanzania | Personal Data Protection Commission (Tanzania) | 72 hours | 30 days |
| South Africa | Information Regulator (South Africa) | 72 hours | 30 days |
Why it matters
One programme. Country-level context.
Keep local requirements connected to your broader privacy programme.
Applicable frameworks
See the requirements that apply in each of your markets, as controls an inspector checks.
Assigned responsibilities
Clear ownership across teams, entities and countries.
Linked evidence
Evidence collected once counts for every law it satisfies.
Bring your markets into focus.
Let's discuss how hlola can help you manage local data protection requirements as part of one connected privacy programme.