The rules by country
| Country | Where | Main conditions |
|---|---|---|
| Kenya | Data Protection Act, 2019, ss.48 to 50 | Proof of appropriate safeguards or an adequate destination; consent and safeguards for sensitive data; the Cabinet Secretary may require some processing to stay in Kenya |
| Nigeria | NDPA 2023, ss.41 to 43 | An adequate level of protection in the destination, or another basis the Act allows, such as consent or contractual necessity |
| South Africa | POPIA, s.72 | Adequate protection by law, binding rules or agreement; consent; or necessity for a contract |
| Rwanda | Law No 058/2021 | Storage outside Rwanda only with an NCSA authorisation certificate |
| EU | GDPR, Chapter V | Adequacy decision, standard contractual clauses or another Chapter V mechanism |
Documenting a transfer
- Which processing activity the transfer belongs to
- The destination country and the recipient
- The legal basis or safeguard relied on
- A transfer risk assessment, where the safeguard needs one
- The contract or authorisation, kept as evidence
The cloud question
Most organisations transfer data abroad without thinking of it as a transfer: email, CRM, payroll and file storage are often hosted outside the country. Start by recording where each system is hosted. In hlola, a system or vendor hosted abroad raises a transfer assessment automatically, and a processor without a contract raises a DPA task.
Common questions
Can personal data be transferred out of Kenya?
Yes, where the controller shows appropriate safeguards or an adequate level of protection in the destination, under sections 48 to 50 of the Data Protection Act; sensitive data needs consent and safeguards.
Does using a foreign cloud provider count as a transfer?
Yes. Personal data stored on servers outside the country is transferred abroad, so the transfer rules apply.
Which African country restricts storing data abroad most?
Rwanda, which requires an NCSA authorisation certificate to store personal data outside the country.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.