Bimonthly Update on Privacy in Africa (July & August 2026)

Introduction

The AI governance and data protection landscape in Africa saw defining moments over the past two months. Several African countries joined the China-led AI organisation. Meanwhile, Botswana, Kenya, and Uganda are developing their AI policies and strategies. Data Protection Authorities (DPAs) issued various guidance notes and directives, aiming to improve compliance.

Trend Spotlight: Data Rules Move Into the Infrastructure Layer (Contribution by Digital Policy Alert)

Over the past two months, African data governance advanced further into implementation, with rules now applying to digital infrastructure. In Nigeria, the National Digital Cloud Policy incorporated provisions on data localisation and cross-border data transfers within its cloud governance framework and established an implementation task force, while the Internet Code of Practice entered into force, introducing requirements related to cybersecurity and AI deployment. Ethiopia adopted cybersecurity obligations for critical infrastructure providers, and Egypt introduced measures related to digital identity infrastructure. In Kenya, the data protection authority focused on regulatory guidance, launching a consultation on applying the Data Protection Act to AI systems and other emerging technologies.

Data Protection

On July 19, 2026, the ECOWAS Authority adopted the Revised Supplementary Act on Personal Data Protection, alongside regional instruments on cybersecurity, open data, and digital governance.
Kenya’s Data Commissioner has announced that the EU adequacy technical evaluation on Kenya is nearing completion and the decision is being drafted. She also said the DPA will publish guidance on AI and cross-border transfers shortly, and is working towards an EAC data protection framework.
On August 25, 2026, the Government of Comoros, in partnership with the African Union Development Agency (AUDA-NEPAD), validated the country’s first National Data Governance Strategy. The strategy promotes responsible, citizen-centred data governance alongside digital infrastructure, interoperability, data value creation and skills. The strategy aligns with the AU Data Policy Framework and includes an implementation plan to translate the priorities into practical measures.
On August 3, 2026, Burkina Faso's Parliament passed a bill establishing the Regulatory Authority for Communication and the Protection of Personal Data (ARCOD), a single regulatory authority overseeing both communications and personal data protection, including emerging AI challenges.
In Nigeria, the Data Privacy Lawyers Association of Nigeria (DPLAN) has petitioned the DPA over the rising cost of data protection compliance within the country. DPLAN requests the DPA to review the statutory fees associated with data protection compliance, noting that the current pricing structure could discourage compliance, particularly among startups and SMEs. DPLAN also called for a transparent official fee schedule and tiered fees based on organisational size, turnover and risk.
Uganda’s DPA has issued a public notice directing all data controllers and processors to prepare and submit their Annual Compliance Reports by November 23, 2026 through its website.
Malawi’s DPA has issued a notice to content creators that publishing intimate content without a lawful basis amounts to unlawful processing of personal data and would attract a fine of up to K20 million.
Eswatini’s Government has announced that it is expecting to complete the National Data Governance Policy by year-end. The policy aims to harmonise and protect national data and will inform whether dedicated law is required or existing legislation should be amended.
In Mauritius, the DPA has announced that the Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 will take effect on January 1, 2027. Consequently, all public and private organisations must designate a DPO; failure to do so may result in a fine of up to Rs 100,000 and imprisonment of up to five years.
Tanzania’s DPA, in partnership with the Open University of Tanzania, announced a national Certified Data Protection Authorised (CDPA) programme to strengthen DPO competence and reduce privacy risks.
Mali's DPA has warned against publishing images of alleged criminal suspects on social media without authorisation, emphasising that personal images require lawful processing and prior consent under data protection law.
Kenya's DPA published draft guidance notes on AI, Emerging Technologies, and Privacy-Enhancing Technologies; the Transport Sector; and Guidance Notes for DPOs on appointment for public comment.
Mauritius's DPA published a Data Protection Guide for the Financial Sector, providing practical compliance guidance for banks, insurers, fintechs, and other institutions under the Data Protection Act.
The Socio-Economic Rights and Accountability Project (SERAP) has petitioned the Senate to reject the NDP Act (Amendment) Bill 2026, which would mandate physical offices for social media firms and allow operations to be shut down, tagging it an unconstitutional restriction on online expression.
The Socio-Economic Rights and Accountability Project (SERAP) has petitioned the Senate to reject the NDPA (Amendment) Bill 2026, which would mandate physical offices for social media firms and allow operations to be shut down, tagging it an unconstitutional restriction on online expression.
Nigeria's Federal Government issued a compliance circular directing all Ministries, Departments, and Agencies (MDAs) to comply with the NDPA by appointing DPOs, engaging licensed DPCOs, budgeting for compliance, and filing annual audits under the NDPA.
UNESCO published a Digital Platform Governance Toolkit tailored for Namibia, South Africa, and Zambia, offering diagnostic checklists and legal building blocks to evaluate and strengthen platform regulation.
In Nigeria, the Internet Code of Practice 2026 entered into force, including data protection and cybersecurity provisions for internet and telecom infrastructure providers. The Federal Government also adopted a National Digital Cloud Policy carrying a data localisation requirement and a cross-border data transfer regulation, and the National Information Technology Development Agency inaugurated an implementation taskforce to oversee the wider cloud initiative.

Enforcement

The High Court ruled against a fintech for opening an unauthorised account for a customer without consent, noting that the fintech failed to verify data accuracy and breached the NDPA. The High Court ordered another bank to pay N15 million to former customers without obtaining consent. Additionally, the court also ruled that requiring Bank Verification Numbers (BVN) for insurance policy issuance violates constitutional privacy rights, declaring National Identification Numbers (NIN) sufficient.
Nigeria's Federal High Court has upheld the NDPC's authority to register PoS agents as Data Controllers and Processors of Major Importance (DCPMIs) under the Ordinary High Level Category. The court noted that ruling that the registration framework under the Guidance Notice and NDPA 2023 does not violate constitutional privacy rights, but rather safeguards them through regulatory oversight.
Kenya's DPA fined a data controller KES 300,000 for the unauthorised commercial use of a minor's sensitive personal data.
The NDPC launched an investigation into UNILAG, Lotus Bank, and Hackerbella Ltd over allegations of using student data to open unauthorised bank accounts without a lawful basis.
Angola's DPA fined two organisations a total of 225,000 USD for processing data without prior authorisation and failing to implement adequate technical safeguards.
Botswana's DPA issued an enforcement notice against the Directorate of Public Service Management (DPSM) over its ePayslip portal, directing an immediate suspension until a proper DPIA is conducted and lawful processing bases are established.

AI Governance

On July 6, 2026, six Francophone West African nations, including Benin, Burkina Faso, Côte d'Ivoire, Guinea, Mali, and Senegal, adopted a shared governance framework to promote responsible and ethical AI.
Kenya published its draft AI and Emerging Technologies Policy 2026 for consultation. The policy proposes an AI and Emerging Technologies Governance Act, a National AI Council and an AI Safety Institute, alongside programmes for AI missions, compute access, a National Data Library, African-language AI, worker protections, reskilling and interoperability.
Representatives of 29 countries, including ten African states, signed the agreement establishing the World AI Cooperation Organisation (WAICO). The organisation will promote international cooperation on AI governance, standards and ethical principles. African founding members include Algeria, Cameroon, Congo, Ethiopia, Kenya, Lesotho, Mozambique, Senegal, South Africa and Zambia, positioning China as a significant strategic partner for AI development in Africa.
Uganda’s Ministry of ICT announced a draft National AI and Emerging Technologies Strategy, currently under internal review before submission to Cabinet.
From August 17 to 21, 2026, Lesotho's Ministry of Information, Communications, Science, Technology and Innovation, in collaboration with the United Nations, held a five-day capacity-building workshop to begin drafting a National AI Strategy and a Data Centre Blueprint.
Botswana is progressing towards a National AI Policy for 2026–2030 focused on economic diversification, innovation, entrepreneurship and job creation. The policy will operate alongside the Data Protection Act 2024 and Cybersecurity Act 2025. Similarly, Malawi is finalising a National AI Strategy and an accompanying AI Bill to regulate public and private sector deployments while enhancing public service cybersecurity.
On August 19, 2026, COMESA opened regional consultations in Malawi towards a Regional AI Strategy, Digital Inclusion Strategy, Action Plan and model regulatory frameworks. The process addresses AI readiness, use cases and regulation, alongside connectivity, skills, affordability, accessible services and digital trust and safety.
On August 17, 2026, Mozambique’s National Institute of Information and Communication Technologies presented a proposed National AI Strategy structured around digital inclusion, economic growth, and ethics and governance. Complementary regulatory instruments are also being developed to operationalise the legal framework and support ethical and sustainable development of emerging technologies.
Algeria has begun implementing its national AI strategy through an inter-ministerial roadmap focused on AI in public services and technological sovereignty. Priorities include sovereign open-source government models, domestic computing capacity, national AI talent programmes, a research centre, secure national data storage and ethical deployment, supported by a joint monitoring committee.
Zimbabwe announced plans for a Digital Industrial One-Stop Policy to bolster cyber infrastructure, streamline e-commerce, and accelerate AI adoption across core economic sectors.
South Africa's Digital Technologies Minister has announced an upcoming preliminary report from an independent panel tasked with redrafting the national AI policy statement following its earlier withdrawal.
Egypt has been elected chair of both the AI Governance and Quantum Computing Working Groups under the Arab Permanent Committee for AI and Emerging Technologies.
A UN-backed Coalition for Children’s Rights and Protection in the Age of AI was launched to place children’s rights at the centre of AI governance. The coalition, comprising 17 countries including Kenya, will share evidence and policy approaches grounded in the Convention on the Rights of the Child.
Morocco has published a national white paper on AI in healthcare, setting out recommendations on technology adoption, data governance, professional training, innovation and future AI-enabled healthcare services.

Partnership

On August 18, 2026, Benin’s DPA and Togo’s DPA formalised a partnership following a working visit. The authorities will cooperate on information and expertise sharing, training, awareness, controls, compliance, research and emerging technologies, including cross-border data processing.
On July 15, 2026, on the sidelines of the AI for Good Global Summit, the African Union Commission (AUC) and the International Telecommunication Union (ITU) signed a Memorandum of Understanding (MoU) to strengthen cooperation on Africa's digital transformation. The partnership focuses on key areas, including AI, digital public infrastructure, and digital and AI skills development.
On July 9, 2026, Kenya's Ministry of Information, Communications and the Digital Economy hosted a United States delegation in Nairobi. The meeting aimed to explore opportunities to deepen cooperation in technology investment, data governance, and the responsible development of AI.
At the World Summit on the Information Society, Egypt's MCIT held high-level meetings with Kenya, the United Nations Development Programme (UNDP), and the World Bank Group to advance cooperation on AI, digital transformation, and communications infrastructure.
Egypt and Rwanda signed a memorandum of understanding on AI and digital transformation.

‍

Conclusion

In the coming months, we anticipate more cooperation and partnerships in the region. We also predict more enforcement actions from DPAs.

‍