The laws at a glance
| Country | Law | Regulator | Registration |
|---|---|---|---|
| Kenya | Data Protection Act, 2019 | Office of the Data Protection Commissioner (ODPC) | Required, with exemptions for small organisations outside listed sectors |
| Nigeria | Nigeria Data Protection Act, 2023 | Nigeria Data Protection Commission (NDPC) | Required for data controllers and processors of major importance |
| South Africa | Protection of Personal Information Act, 2013 | Information Regulator | Information Officer registration |
| Ghana | Data Protection Act, 2012 (Act 843) | Data Protection Commission | Required, renewed every two years |
| Uganda | Data Protection and Privacy Act, 2019 | Personal Data Protection Office (PDPO) | Required |
| Rwanda | Law No 058/2021 | National Cyber Security Authority (NCSA) | Required |
| Tanzania | Personal Data Protection Act, 2022 | Personal Data Protection Commission (PDPC) | Required |
What they have in common
- Principles of lawfulness, purpose limitation, minimisation, accuracy, storage limitation and security
- A lawful basis for processing, with consent as one option among several
- Rights to access, correct and delete personal data, and to object
- Stricter rules for sensitive data such as health, biometric and children's data
- Conditions on transferring data across borders
- A duty to notify the regulator of breaches
Where they differ
Registration is the biggest difference from the GDPR: most African regulators keep a register and charge a fee. Kenya requires DPIAs to be submitted to the regulator before high-risk processing. Rwanda requires authorisation to store data abroad. South Africa protects companies' information as well as individuals'. Breach deadlines range from 48 hours to "as soon as reasonably possible"; see the deadline comparison.
Each law's controls, regulator and statutory clocks are on its framework page.
Common questions
Which African countries have data protection laws?
Most do. This guide covers Kenya, Nigeria, South Africa, Ghana, Uganda, Rwanda and Tanzania, each with a dedicated statute and regulator.
Do African data protection laws require registration?
Most do. Kenya, Ghana, Uganda, Rwanda and Tanzania require registration of controllers and processors, Nigeria requires it for those of major importance, and South Africa requires the Information Officer to be registered.
Are African data protection laws based on the GDPR?
Many share the GDPR's principles and rights, but add local duties such as registration, regulator review of DPIAs and data storage rules.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.