Home · Archive
The complete archive of the Digest's published coverage: analysis, data protection news, enforcement orders and regulatory developments from across Africa. 45 entries across 10 jurisdictions.
Every VASP operating in Kenya must comply with the VASP Act 2025 by 4 November 2026. The implementing regulations that define what compliance means have not been gazetted. That combination is the compliance story of the Kenyan crypto year.
The UK ICO published guidance on AI-generated freedom of information requests in May 2026. African DPAs cite ICO precedent habitually, and Nigeria's NDPC has already signed a 60-authority statement on AI imagery. Public bodies should read this as a preview.
Two 2026 decisions close the gap between an ODPC determination and real consequences: criminal exposure for directors, and High Court execution machinery for compensation awards.
The ODPC opened a suo moto investigation into Ray-Ban Meta smart glasses after reporting revealed footage from the devices was being reviewed by human contractors in Nairobi to train Meta's AI. After Worldcoin, the direction is unmistakable.
The central bank for eight West African states surveyed fintechs on crypto in February, then convened an international crypto-assets conference in Dakar in May. When the BCEAO finally regulates, one framework lands in eight countries on the same day.
Investigations into Temu and the Corporate Affairs Commission, a security advisory with mandatory upgrades, MoUs reaching procurement and all 36 states: the NDPC's 2026 is a build-out of enforcement infrastructure, not a run of one-off cases.
The Pharmacy and Poisons Board now regulates software as a medical device: a four-category IMDRF risk matrix, registration through the Board's portal, cybersecurity documentation, and ten Good Machine Learning Practice principles for AI. Health apps that diagnose or treat sit in the highest categories, and the guideline orders compliance with the Data Protection Act 2019 and the Digital Health Act 2023 by name.
The ODPC's own statistics, announced ahead of the 2026 Data Privacy Day Conference, describe the most active enforcement docket on the continent. The pattern in the data tells you who gets investigated.
Fourteen years after Act 843, Ghana's DPC has moved from awareness campaigns to nationwide enforcement, with a new Data Protection Bill queued behind it. Registration is the exposed flank.
Ghana's VASP Act (Act 1154) took Africa's standalone crypto statutes to three inside a quarter, and its SEC sandbox admitted its first participant within four months of assent. The anglophone West African licensing model is converging fast.
Proclamation 1321/2024 carries 4%-of-turnover penalties and prison terms, yet two years in there are no implementing directives, no registration portal and no enforcement. Meanwhile the National Bank banned birr-paired crypto P2P in one statement.
What POPIA means is being decided in litigation the Regulator keeps initiating: matric results, telemarketing, WhatsApp, and a contested R5 million fine. The scoreboard so far favours respondents.
South Africa exited the FATF grey list in October 2025. What followed was not relaxation but codification: draft Capital Flow Management Regulations that classify crypto as 'capital', CARF reporting from March 2026, and 30 FSCA inspections in a year.
The NDPA 2023 sets the principles. The General Application and Implementation Directive is where Nigerian compliance obligations actually live. If your programme was built on the NITDA-era regulation, it is out of date.
Uganda's data protection authority held that a company with no Ugandan office, staff or servers is still a regulated data controller. The reasoning travels.
Iris scans in exchange for about $50 in tokens, no DPIA. The High Court's Worldcoin ruling is the reference point for every biometric processing question in Kenya, and no appeal has been filed.
Enforcement decisions, new laws and regulatory movement across African jurisdictions, in one brief. Free, and built to be forwarded to the colleague who needs it.
Your address goes to our email service provider and is used to send you the Digest, nothing else. Unsubscribe in one click, in every issue. Privacy policy. This site itself sets no cookies.