Archive · Enforcement
All 16 archive entries filed under enforcement, most recent first.
In a determination dated 14 April 2026 (Peter Macharia Waithira v LOLC MFB), Data Commissioner Immaculate Kassait held LOLC Kenya Microfinance Bank liable for publishing a former employee's image and personal details in public notices on its social media platforms without consent or lawful basis, and ordered deletion within 14 days. The Commissioner also recommended the bank's directors for criminal prosecution for obstruction, after the lender failed to cooperate with the investigation, with fines of up to KES 5 million or two years' imprisonment on conviction.
The FSCA imposed a R350,000 administrative penalty on Thembnkululeko Construction (Pty) Ltd, a registered financial services provider (FSP 53486), for regulatory violations, announced 10 April 2026. No systemic issue underlies this action; it is a routine penalty against a named entity within the Authority's continuing compliance programme.
The Gauteng High Court interdicted Fusion Guarantees (Pty) Ltd from issuing construction guarantees, holding in a 23 March 2026 judgment (Elasah Risk Consultants v National Credit Regulator and Others) that such guarantees meet the definition of non-life insurance under the Insurance Act 18 of 2017: premiums paid, an undertaking triggered by an uncertain event, and indemnification of loss.
The FSCA imposed an administrative penalty of R358,750,000 (approximately USD 18.9 million) on Stephanus Johannes Stehan Grobler, formerly Steinhoff International's chief legal and treasury officer, for materially misleading financial statements covering 2014 through the 2017 half-year, in breach of the Financial Markets Act. The penalty is among the largest individual fines in the FSCA's history, alongside the R475 million penalty earlier imposed on former CEO Markus Jooste. This is market-integrity enforcement, not data protection enforcement.
The FSCA imposed a R710,000 administrative penalty on QuickTrade (Pty) Ltd, an online CFD and forex broker, for multiple breaches of the Financial Intelligence Centre Act, including customer due diligence and anti-money laundering control failures, and coupled the fine with a remediation directive. The action forms part of the FSCA's continuing anti-money laundering sweep of retail trading platforms.
In Muthoni v Africa International University [2026] KEHC 2254 (KLR), decided 16 February 2026, the High Court considered an application to adopt a July 2025 ODPC determination (Complaint No.
SEC Nigeria revoked the registration of Kensington Agro Trading Limited as a capital market operator, with immediate effect, in a circular signed 9 February 2026 and published 2 March, acting under section 61(6) of the Investments and Securities Act 2025 and Rule 34(1) of the SEC Rules.
On 30 January 2026, SEC Nigeria issued a public warning against Aurum Bot, an online platform soliciting cryptocurrency investments from Nigerian retail investors without registration or a licence.
SEC Nigeria's second public warning of 30 January 2026 named ModMount Services Limited, a CFD broker offering forex, stocks, indices, commodities and cryptocurrency to Nigerian investors, as unlicensed and suspected of fraudulent activity. Unlike a plain scam, ModMount presents as a legitimate international broker giving Nigerians access to global markets, with offshore licensing claims standing in for local authorisation.
At the launch of Ghana's 2026 Data Protection Week on 26 January, DPC Executive Director Arnold Kavaarpuo confirmed that full-scale enforcement under the Data Protection Act 2012 (Act 843) began in January 2026, with unregistered data controllers facing fines and possible imprisonment. The announcement follows more than a decade of registration drives and awareness campaigns.
On 26 January 2026, ahead of the 2026 Data Privacy Day Conference in Mombasa, Kenya's ODPC announced that it had issued 184 compensation orders to data subjects, against a cumulative docket of 9,061 complaints, 357 determinations, 134 enforcement notices and 20 penalty notices since the Data Protection Act 2019 took effect. The High Court has held that it will not disturb the ODPC's compensation discretion unless a decision is irrational, which gives those orders real legal force.
The Information Regulator sought leave to appeal a North Gauteng High Court ruling that allowed the Department of Basic Education to publish the 2025 matric results in newspapers despite the Regulator's enforcement notice prohibiting it.
At a media briefing on 13 November 2025, Information Regulator Chairperson Adv Pansy Tlakula disclosed enforcement notices against Blouberg Municipality, Lancet Laboratories and FT Rams Consulting, a settlement with WhatsApp that is to be made an order of court, ongoing litigation against the Department of Basic Education over the matric results, and the Regulator's intention to seek a court ruling on whether telemarketing falls under POPIA section 69. The briefing set out a docket that shows POPIA's practical scope is increasingly being determined through litigation rather than through the Regulator's own guidance.
On 18 July 2025, Uganda's PDPO found Google LLC in breach of the Data Protection and Privacy Act 2019 for failing to register and for transferring Ugandan users' data abroad without adequate safeguards, ordering registration within 30 days (Ssekamwa Frank & 3 Others v Google LLC). The office rejected Google's no-physical-presence defence outright, holding that any entity collecting or processing Ugandan citizens' data falls within the Act's reach.
Uganda's PDPO found in July 2025 that Google must register locally and evidence its cross-border data transfers, a finding that remains the continent's clearest extraterritoriality holding.
On 5 May 2025, the High Court of Kenya declared Worldcoin's operations unlawful under both the Data Protection Act 2019 and Article 31 of the Constitution, in Republic v Tools for Humanity Corporation & 9 others [2025] KEHC 5629 (KLR).
Enforcement decisions, new laws and regulatory movement across African jurisdictions, in one brief. Free, and built to be forwarded to the colleague who needs it.
Your address goes to our email service provider and is used to send you the Digest, nothing else. Unsubscribe in one click, in every issue. Privacy policy. This site itself sets no cookies.