hlola guides
Data protection law in Africa, explained.
What each country's law asks of you, in plain language: registering with the regulator, reporting breaches, answering rights requests, assessing risk and moving data across borders.
Across Africa
Breaches · 3 min read
Data breach notification deadlines across Africa
How long you have to report a personal data breach in Kenya, Nigeria, South Africa, Ghana, Uganda, Rwanda and Tanzania, compared with the GDPR's 72 hours, with each law's own wording.
Read the guideCompliance · 3 min read
Data protection laws in Africa: a country-by-country overview
An overview of data protection laws in Kenya, Nigeria, South Africa, Ghana, Uganda, Rwanda and Tanzania: the statute, the regulator, registration, and the headline obligations.
Read the guideCompliance · 3 min read
GDPR vs African data protection laws: what changes when you expand
How Kenya's DPA, Nigeria's NDPA and South Africa's POPIA differ from the GDPR, and what a GDPR-compliant organisation still has to do when it operates in African markets.
Read the guideRecords · 3 min read
How to create a record of processing activities (ROPA)
A step-by-step guide to building a record of processing activities: the columns to include, how to gather the information, and how to keep it current. Free ROPA template included.
Read the guideTransfers · 3 min read
Cross-border data transfers in Africa: what each law requires
The rules for transferring personal data out of Kenya, Nigeria, South Africa and Rwanda, including adequacy, safeguards, consent and Rwanda's storage authorisation, and how to document each transfer.
Read the guide
Kenya
The law in hlolaRegistration · 3 min read
How to register with the ODPC in Kenya
Who must register as a data controller or data processor with Kenya's Office of the Data Protection Commissioner, the exemption thresholds, fees, and what to prepare before you apply.
Read the guideBreaches · 3 min read
Data breach notification in Kenya: the 72-hour rule
What section 43 of the Kenya Data Protection Act requires after a personal data breach: notifying the Data Commissioner within 72 hours, telling affected people, and the 48-hour duty on processors.
Read the guideRights · 3 min read
Data subject rights and access requests in Kenya
The rights section 26 of Kenya's Data Protection Act gives individuals, how fast you must answer an access request, and how to verify identity and record the response.
Read the guidePenalties · 3 min read
Kenya Data Protection Act penalties and ODPC enforcement
The fines the Data Commissioner can impose under section 63 of Kenya's Data Protection Act, how enforcement and penalty notices work, and what ODPC decisions so far have punished.
Read the guideAssessments · 3 min read
When you need a data protection impact assessment in Kenya
When section 31 of Kenya's Data Protection Act requires a DPIA, what it must contain, and how to submit it to the Data Commissioner before high-risk processing starts.
Read the guide
Nigeria
The law in hlolaCompliance · 3 min read
NDPA 2023 compliance guide for Nigerian organisations
What the Nigeria Data Protection Act, 2023 requires: the principles, lawful bases, data controllers of major importance, DPIAs, breach reporting and the NDPC's enforcement powers.
Read the guideBreaches · 3 min read
Data breach notification under Nigeria's NDPA
How to report a personal data breach to the Nigeria Data Protection Commission within 72 hours under section 40 of the NDPA 2023, when to tell data subjects, and what to include.
Read the guideRegistration · 3 min read
Data controllers of major importance in Nigeria: NDPC registration
What makes an organisation a data controller or processor of major importance under the NDPA 2023, the registration duty in section 44, the DPO requirement and annual compliance audit returns.
Read the guide
South Africa
The law in hlolaCompliance · 3 min read
POPIA compliance checklist: the eight conditions
A practical POPIA compliance checklist built on the Act's eight conditions for lawful processing, from accountability to data subject participation, with the evidence each one needs.
Read the guideRegistration · 3 min read
Registering your Information Officer under POPIA
Who the Information Officer is under POPIA, their duties under section 55, how to register them and deputy Information Officers with the Information Regulator, and the PAIA manual.
Read the guideBreaches · 3 min read
POPIA section 22: notifying a security compromise
When POPIA section 22 requires you to notify the Information Regulator and data subjects of a security compromise, what "as soon as reasonably possible" means in practice, and what to include.
Read the guide
Uganda
The law in hlolaRwanda
The law in hlolaTurn the guide into a programme.
hlola loads your country's law as controls, with its deadlines, evidence and owners, so the work in these guides is tracked rather than remembered.