The deadlines side by side
| Country | Law | Regulator | Deadline to notify the regulator |
|---|---|---|---|
| Kenya | Data Protection Act, 2019 (s.43) | ODPC | 72 hours from awareness; processors tell controllers within 48 hours |
| Nigeria | NDPA 2023 (s.40) | NDPC | 72 hours from awareness |
| South Africa | POPIA (s.22) | Information Regulator | As soon as reasonably possible after discovery |
| Ghana | Act 843 (s.31) | Data Protection Commission | As soon as reasonably practicable after discovery |
| Uganda | DPPA 2019 (s.23) | PDPO | Immediately |
| Rwanda | Law No 058/2021 | NCSA | 48 hours from awareness |
| Tanzania | PDPA 2022 and 2023 Regulations | PDPC | As the Regulations require; confirm with counsel |
| EU / international | GDPR (Art. 33) | Lead supervisory authority | 72 hours from awareness, where feasible |
Where the law uses words, not hours
"As soon as reasonably possible" is not a licence to wait. Regulators judge it against what you knew and when, and a notification after a week of internal debate is hard to defend. Most organisations with operations in several African countries set one internal outer limit of 72 hours, or 48 where Rwanda applies, and treat "immediately" in Uganda as hours, not days.
Running one process for many countries
- Record the awareness time once, for the incident as a whole
- Identify every entity whose data subjects are affected
- Start a clock per entity, using that entity's law
- Make one notification decision per regulator, with reasons
- Keep each regulator's acknowledgement as evidence
hlola's incident register does this: one incident, a clock per affected entity set by its country's law, and the decision and acknowledgement kept for each regulator.
Common questions
Which African country has the shortest breach notification deadline?
Rwanda, at 48 hours to the NCSA. Uganda's DPPA says "immediately", which in practice should be treated as hours.
Is the breach deadline 72 hours everywhere in Africa?
No. Kenya and Nigeria set 72 hours, Rwanda 48, and South Africa, Ghana and Uganda use wording such as "as soon as reasonably possible" or "immediately" instead of hours.
Does POPIA have a 72-hour rule?
No. Section 22 of POPIA requires notification as soon as reasonably possible after discovery. Many organisations adopt 72 hours as an internal outer limit.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.