Written By | Staff Writer
Egypt’s licensing deadline has just passed, Nigeria is running its regulator on enforcement revenue, Kenya is ordering compensation and South Africa is fining banks.
Search
Technological Transformation
For most of the last decade, African data-protection law was more aspiration than constraint. Countries passed statutes modelled on Europe’s GDPR, created commissions with small budgets and few staff, and asked companies to register. Enforcement was rare, fines were symbolic, and many startups treated privacy as a box to tick when raising money from foreign investors.
2026 is the year that changed in Africa’s four largest digital markets. In the past twelve months, regulators in North, West, East and Southern Africa have moved from issuing guidance to issuing penalties, compensation orders and licence requirements. As of this week, Egypt has joined them. For the continent’s fintechs, telcos, lenders, health platforms and AI developers, compliance is now a real operating cost and, increasingly, a source of competitive advantage.
North Africa: Egypt’s Compliance Clock Runs Out
Egypt passed its Personal Data Protection Law (Law No. 151 of 2020) six years ago, but the law could not be enforced until its Executive Regulations were issued. Those regulations, No. 816 of 2025, were issued on 1 November 2025 and gave businesses a one-year transition. Law firms put the end of that period at 31 October or 1 November 2026, which means it ended this weekend.
Egypt’s model is the most licence-heavy on the continent. The Personal Data Protection Center (PDPC) runs a single “Controller/Processor Licence” that covers both data controllers and data processors. Separate permits are needed for processing sensitive data, for transfers across borders, for video surveillance and for electronic direct marketing. Breaches must be reported to the PDPC within 72 hours, and affected people must be told within three business days. Foreign companies processing Egyptians’ data may need a local representative. Penalties include fines of up to EGP 5 million and, for some offences, imprisonment.
For Egypt’s fast-growing fintech, e-commerce and outsourcing industries, the licensing approach creates a gate that did not exist before. It is also a test of administrative capacity. Legal advisers have given conflicting accounts during 2026 of whether the PDPC’s online licensing portal is fully operational. If the regulator cannot process applications quickly, thousands of companies could be technically non-compliant through no fault of their own.
West Africa: Nigeria’s Enforcement-Funded Regulator
Nigeria has gone furthest in turning data protection into an active enforcement operation. The Nigeria Data Protection Act was signed on 12 June 2023 and created the Nigeria Data Protection Commission (NDPC). Its General Application and Implementation Directive became fully effective on 19 September 2025. The penalty ceiling is significant: up to ₦10 million or 2 percent of the previous year’s gross revenue, whichever is greater.
The NDPC itself describes 2026 as the start of “full enforcement mode”. By early 2026 it had reportedly collected about ₦7.2 billion from registrations, compliance-audit fees and fines. It had concluded more than 240 investigations, which produced 11 major enforcement actions. On 19 February 2026 it sent compliance notices to 649 higher-education institutions, giving them 21 days to show they had appointed data protection officers and filed audit returns. The deadline for 2025 compliance audit returns was extended from 31 March to 30 May 2026.
The headline cases show both what the Commission can do and where its limits are. In February 2025 it fined Meta $32.8 million over data-transfer and consent violations. Meta later settled out of court, which was confirmed to the Federal High Court in November 2025. In June 2025 the NDPC fined MultiChoice Nigeria ₦766,242,500 over cross-border data handling. In April 2026 it served a notice of investigation on Remita Payment Services and Sterling Bank over an alleged large-scale breach of payment data. Seven months later, no final public finding has been published.
Nigeria’s regime has also created a new industry. Licensed Data Protection Compliance Organisations, auditors and trainers make up a market estimated at ₦16.2 billion. Critics say this design gives the regulator an incentive to emphasise registration fees and audit filings over harder investigations into breaches, and that a body which partly funds itself from compliance revenue faces a structural conflict.
East Africa: Kenya Puts Money in Complainants’ Hands
Kenya’s Office of the Data Protection Commissioner (ODPC), created under the Data Protection Act 2019, has taken a different route. Its most visible tool is compensation paid to individuals, not large corporate fines. Reports citing the ODPC say it has received 9,061 complaints since the Act took effect. It has issued 357 determinations, 134 enforcement notices and 20 penalty notices, and resolved 84 cases through alternative dispute resolution. In January 2026 alone it reportedly issued 184 compensation orders.
The individual amounts are modest but meaningful. In one case, two complainants were each awarded KSh 250,000 against a laboratory that kept sending marketing messages after they had opted out. In another, KSh 250,000 was awarded against a former employer that refused a woman access to her own background-check data. In October 2026 a court fined a homeowner KSh 200,000, based on an ODPC finding, for pointing CCTV cameras at a neighbour’s property. Each award signals to Kenya’s large SMS-marketing, digital-lending and HR-tech industries that ignoring individual rights now has a price.
The constraint is the penalty ceiling. Kenya’s maximum administrative fine is KSh 5 million, or 1 percent of turnover, whichever is lower. For a large telco or bank, that is a rounding error. A pending Data Protection (Amendment) Bill would make it “whichever is higher”, but the bill had not been enacted at the time of writing. Until it is, Kenya’s regime will discipline small firms more than large platforms.
Southern Africa: South Africa Fines the Banks
South Africa’s Protection of Personal Information Act (POPIA) has been fully in force since 2021. Its Information Regulator has been slower to fine than its caseload would suggest. By one count it had logged more than 8,000 breach notifications by August 2026 but issued only six administrative fines. The statutory maximum is R10 million.
The pace is picking up. In late October 2026 the Regulator issued First National Bank with an enforcement notice and a R1 million fine. The case followed 2022 incidents in which a system flaw let ordinary account holders see the personal data of 88 home-loan applicants. The Regulator found breaches across several sections of POPIA, including its security-safeguard provisions. Separately, Central Johannesburg TVET College was fined R500,000 after failing to comply with a May 2026 enforcement notice. That case is notable because the Regulator treated an internal, accidental disclosure as a reportable “security compromise”. Direct-marketing complaints involving MTN and OUTsurance have also been referred to the Regulator’s Enforcement Committee.
A R1 million fine is small for one of Africa’s largest banks. The bigger cost is reputational: the enforcement notice, the public finding and the remediation it requires. South African banks now treat that combination as a material risk, alongside cyber incidents.
What This Means for Africa’s Tech Sector
Four patterns emerge from these cases.
The AI Question
The timing matters because AI adoption is accelerating. African-language voice models, credit-scoring algorithms trained on mobile-money histories and clinical AI tools all depend on large volumes of personal data. Rules on consent, purpose limitation and automated decision-making will determine which of these products can be built legally, and where. Companies that treat privacy as part of product design, collecting less, anonymising early and documenting lawful bases, will find it easier to scale across borders than those that try to retrofit compliance after a regulator calls.
Conclusion
Africa’s data-protection regimes have reached the point where they cost something to ignore. The penalties are still small next to the revenues of the firms being fined. Enforcement is uneven, and some outcomes, like Remita and Sterling, remain unpublished. But the direction is clear. Egypt’s deadline has passed, Nigeria’s regulator is collecting billions of naira, Kenya’s is paying complainants, and South Africa’s is naming banks. For digital economies built on trust in mobile wallets, digital IDs and online lenders, credible privacy enforcement is becoming part of the infrastructure, alongside the fibre and the data centres.
