Archive · Enforcement
All 16 archive entries filed under enforcement, most recent first.
In a determination dated 14 April 2026 (Peter Macharia Waithira v LOLC MFB), Data Commissioner Immaculate Kassait held LOLC Kenya Microfinance Bank liable for publishing a former employee's image and personal details in public notices on its social media platforms without consent or lawful basis, ordered deletion within 14 days, and recommended the bank's directors for criminal prosecution for obstruction after the lender failed to cooperate with the investigation, with fines up to KES 5 million or two years' imprisonment on conviction.
The FSCA imposed a R350,000 administrative penalty on Thembnkululeko Construction (Pty) Ltd, a registered financial services provider (FSP 53486), for regulatory violations, announced 10 April 2026.
The Gauteng High Court interdicted Fusion Guarantees (Pty) Ltd from issuing construction guarantees, holding in a 23 March 2026 judgment (Elasah Risk Consultants v National Credit Regulator and Others) that such guarantees meet the definition of non-life insurance under the Insurance Act 18 of 2017: premiums paid, an undertaking triggered by an uncertain event, indemnification of loss.
The FSCA imposed an administrative penalty of R358,750,000 (about USD 18.9 million) on Stephanus Johannes Stehan Grobler, formerly Steinhoff International's chief legal and treasury officer, for materially misleading financial statements covering 2014 through the 2017 half-year, in breach of the Financial Markets Act.
The FSCA imposed a R710,000 administrative penalty on QuickTrade (Pty) Ltd, an online CFD and forex broker, for multiple breaches of the Financial Intelligence Centre Act, including customer due diligence and AML control failures, and coupled the fine with a remediation directive.
In Muthoni v Africa International University [2026] KEHC 2254 (KLR), decided 16 February 2026, the High Court dealt with an application to adopt a July 2025 ODPC determination (Complaint No.
SEC Nigeria revoked the registration of Kensington Agro Trading Limited as a capital market operator with immediate effect, in a circular signed 9 February 2026 and published 2 March, acting under section 61(6) of the Investments and Securities Act 2025 and Rule 34(1) of the SEC Rules.
On 30 January 2026 SEC Nigeria issued a public warning against Aurum Bot, an online platform soliciting cryptocurrency investments from Nigerian retail investors without registration or licence.
SEC Nigeria's second public warning of 30 January 2026 named ModMount Services Limited, a CFD broker offering forex, stocks, indices, commodities and cryptocurrency to Nigerian investors, as unlicensed and suspected of fraudulent activity.
At the launch of Ghana's 2026 Data Protection Week on 26 January, DPC Executive Director Arnold Kavaarpuo confirmed that full-scale enforcement under the Data Protection Act 2012 (Act 843) began in January 2026, with unregistered data controllers facing fines and possible imprisonment.
On 26 January 2026, ahead of the 2026 Data Privacy Day Conference in Mombasa, Kenya's ODPC announced it had issued 184 compensation orders to data subjects, against a cumulative docket of 9,061 complaints, 357 determinations, 134 enforcement notices and 20 penalty notices since the Data Protection Act 2019 took effect.
The Information Regulator sought leave to appeal a North Gauteng High Court ruling that let the Department of Basic Education publish the 2025 matric results in newspapers despite the Regulator's enforcement notice prohibiting it.
At a 13 November 2025 media briefing, Information Regulator Chairperson Adv Pansy Tlakula disclosed enforcement notices against Blouberg Municipality, Lancet Laboratories and FT Rams Consulting, a settlement with WhatsApp that is to be made an order of court, ongoing litigation against the Department of Basic Education over matric results, and the Regulator's intention to seek a court ruling on whether telemarketing falls under POPIA section 69.
On 18 July 2025, Uganda's PDPO found Google LLC in breach of the Data Protection and Privacy Act 2019 for failing to register and for transferring Ugandan users' data abroad without adequate safeguards, ordering registration within 30 days (Ssekamwa Frank & 3 Others v Google LLC).
The PDPO's July 2025 finding that Google must register locally and evidence its cross-border transfers remains the continent's clearest extraterritoriality holding; Google's compliance has not been publicly confirmed.
On 5 May 2025 the High Court of Kenya declared Worldcoin's operations unlawful under both the Data Protection Act 2019 and Article 31 of the Constitution, in Republic v Tools for Humanity Corporation & 9 others [2025] KEHC 5629 (KLR).
Enforcement decisions, new laws and regulatory movement across African jurisdictions, in one brief. Free, and built to be forwarded to the colleague who needs it.
Your address goes to our email service provider and is used to send you the Digest, nothing else. Unsubscribe in one click, in every issue. Privacy policy. This site itself sets no cookies.