hlola Resource Centre
Knowledge for a clearer way forward.
Practical privacy resources, organised by country and by the work you need to get done. Templates, country guides and feature guides in one library.
- Country-focused collections
- Practical templates
- Built for privacy teams
The resource spotlight
Free downloadROPA / Starter template
Give every processing activity a clearer place to start.
CSV spreadsheet · imports straight into hlola
Download templateCurated for African markets
Explore by country. Find what matters.
Local context matters. Browse resources through the lens of one market, or search across the whole library.
The resource library
Explore the collection.
Filter by the work you're doing or the country you're working in. Articles and downloadable guides are being prepared and will appear here once published.
Showing 44 of 44 resources
Template · Cross-border
ROPA starter template
A spreadsheet with every column hlola's import reads: activity, purposes, lawful basis, data subjects, systems, retention, recipients and owner.
Records of processingPrivacy teams
CSV spreadsheetDownloadPractical guide · Cross-border
Cross-border data transfers in Africa: what each law requires
The rules for transferring personal data out of Kenya, Nigeria, South Africa and Rwanda, including adequacy, safeguards, consent and Rwanda's storage authorisation, and how to document each transfer.
Transfers
GuideOpenPractical guide · Cross-border
Data breach notification deadlines across Africa
How long you have to report a personal data breach in Kenya, Nigeria, South Africa, Ghana, Uganda, Rwanda and Tanzania, compared with the GDPR's 72 hours, with each law's own wording.
Breaches
GuideOpenPractical guide · Kenya
Data breach notification in Kenya: the 72-hour rule
What section 43 of the Kenya Data Protection Act requires after a personal data breach: notifying the Data Commissioner within 72 hours, telling affected people, and the 48-hour duty on processors.
Breaches
GuideOpenPractical guide · Nigeria
Data breach notification under Nigeria's NDPA
How to report a personal data breach to the Nigeria Data Protection Commission within 72 hours under section 40 of the NDPA 2023, when to tell data subjects, and what to include.
Breaches
GuideOpenPractical guide · Nigeria
Data controllers of major importance in Nigeria: NDPC registration
What makes an organisation a data controller or processor of major importance under the NDPA 2023, the registration duty in section 44, the DPO requirement and annual compliance audit returns.
Registration
GuideOpenPractical guide · Cross-border
Data protection laws in Africa: a country-by-country overview
An overview of data protection laws in Kenya, Nigeria, South Africa, Ghana, Uganda, Rwanda and Tanzania: the statute, the regulator, registration, and the headline obligations.
Compliance
GuideOpenPractical guide · Kenya
Data subject rights and access requests in Kenya
The rights section 26 of Kenya's Data Protection Act gives individuals, how fast you must answer an access request, and how to verify identity and record the response.
Rights
GuideOpenPractical guide · Cross-border
GDPR vs African data protection laws: what changes when you expand
How Kenya's DPA, Nigeria's NDPA and South Africa's POPIA differ from the GDPR, and what a GDPR-compliant organisation still has to do when it operates in African markets.
Compliance
GuideOpen
Make knowledge actionable.
Resources are most useful when they connect to real workflows. See how hlola turns guidance into accountable privacy operations.