What carries over
An organisation with a working GDPR programme already has most of the foundations: a record of processing, lawful bases, privacy notices, a rights request process, processor contracts, DPIAs and a breach procedure. African laws use the same building blocks, so the GDPR work is rarely wasted.
What does not
| Topic | GDPR | African laws |
|---|---|---|
| Registration | No general registration duty | Required in Kenya, Ghana, Uganda, Rwanda and Tanzania; for major-importance controllers in Nigeria; Information Officer registration in South Africa |
| DPIAs | Consult the regulator only if high risk remains | Kenya requires DPIAs to be submitted to the Data Commissioner before processing |
| Breach deadline | 72 hours | From 48 hours (Rwanda) to "as soon as reasonably possible" (South Africa) |
| Who is protected | Natural persons | POPIA also protects juristic persons such as companies |
| Data location | Free movement within the EEA | Rwanda requires authorisation to store data outside the country |
| Fines | Up to €20 million or 4% of worldwide turnover | Lower caps, such as KES 5 million or 1% in Kenya and 2% of revenue in Nigeria |
A practical approach
- Keep one record of processing, with each activity linked to the entity and country it belongs to
- Register in every country that requires it, and track renewals
- Run DPIAs to the strictest standard that applies, and submit them in Kenya
- Set breach clocks per entity, by that entity's law
- Review transfer safeguards for data leaving each African country, not only the EEA
hlola runs the GDPR alongside African laws, with each entity's controls loaded from its own country's law. See GDPR in hlola.
Common questions
Is GDPR compliance enough for African markets?
No. It covers most principles and rights, but not local duties such as registration, Kenya's DPIA submission, Rwanda's storage authorisation or local breach deadlines.
Is Kenya's Data Protection Act based on the GDPR?
It follows the GDPR closely in its principles and rights, but adds registration with the ODPC, DPIA submission and its own penalty regime.
Which African law differs most from the GDPR?
South Africa's POPIA, which protects juristic persons, and Rwanda's law, which restricts storing data outside the country, differ the most.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.