DATA PROTECTION DIGEST

Archive · November 2025

November 2025: archive

The 3 archive entries on developments from November 2025.

ET · LEGISLATION

Ethiopia's data protection law turns one with no implementing directives in force

A year after Ethiopia enacted the Personal Data Protection Proclamation No.

November 2025 · Legislation
ZA · ENFORCEMENT

Information Regulator discloses unpublished enforcement notices and a telemarketing test case

At a media briefing on 13 November 2025, Information Regulator Chairperson Adv Pansy Tlakula disclosed enforcement notices against Blouberg Municipality, Lancet Laboratories and FT Rams Consulting, a settlement with WhatsApp that is to be made an order of court, ongoing litigation against the Department of Basic Education over the matric results, and the Regulator's intention to seek a court ruling on whether telemarketing falls under POPIA section 69. The briefing set out a docket that shows POPIA's practical scope is increasingly being determined through litigation rather than through the Regulator's own guidance.

13 November 2025 · Enforcement
KE · LEGISLATION

Kenya's VASP Act in force: existing operators have until 4 November 2026

Kenya's Virtual Asset Service Providers Act 2025 was assented on 15 October 2025 and came into force on 4 November 2025, making Kenya one of East Africa's first jurisdictions with a standalone virtual asset statute. Supervision under the Act splits between the CBK, which covers issuance and custodial services, and the CMA, which covers exchanges, brokers and trading platforms.

4 November 2025 · Legislation · Crypto & digital assets