Most organisations worldwide transfer personal data as part of their everyday operations. This is valid for Africa as well. If you are trying to expand into Africa, you need to be aware that each African country will have its own rules and requirements for transferring personal data out of the country. You have to consider factors like where that data needs to reside and where it can be transferred.

Most African countries have strict requirements about data in general and especially personal data. You have to consider critical factors because they can determine how much money you may need to spend to do business in Africa.

Where can your personal data reside?

We’ve spoken about this in our data protection programme, but some countries in the world, including African countries, place a heavy emphasis on where the personal data of their citizens and residents is stored. Many data protection laws in Africa include data localisation requirements. This essentially means that (personal) data must stay within the country unless certain exceptions apply. You would also need to consider the type of data you are processing because some countries require financial data like tax or credit data to stay within the country, and there may not be any exceptions to this. Practically, these data localisation requirements may have a significant financial impact on your organisation as you may need to invest in in-country databases to store personal data in each country you operate it.

What law applies to the personal data?

You also need to know the law that applies to personal data in the specific African country you want to operate in. Many African countries emphasise data sovereignty, which means that the specific African country’s laws will apply regardless of where their data is situated. For example, Kenya’s data protection law will apply if you are:

  • established or ordinarily resident in Kenya and process personal data while in Kenya; or
  • not established or ordinarily resident in Kenya, but you are processing the personal data of data subjects in Kenya.

You have to know the laws that apply to your personal data, as most African countries have specific requirements when you want to transfer personal data out of the country.

How can we help you?

  • Provide you with a Data Protection in Africa report.
  • Provide you with a matrix of data protection laws for specific African countries.
  • Help you understand more about the impact of African data protection laws on you by accessing our data protection programme with our Africa lens.
  • Answer your specific questions about data protection laws for one or more African countries.
  • Discuss your concerns at our Data Protection in Africa workshops.