Archive · Guidance & policy
All 11 archive entries filed under guidance & policy, most recent first.
The NDPC executed two memoranda of understanding on 8 May 2026, one with the Bureau of Public Procurement and one with the Nigeria Governors' Forum. The Bureau of Public Procurement agreement threads data protection compliance into federal procurement, making every vendor and contractor in the government supply chain auditable on NDPA grounds as part of contract compliance.
The UK Information Commissioner's Office published guidance on 6 May 2026 to help public authorities handle Freedom of Information requests involving or generated by AI systems, addressing the rising volume of AI-generated requests and how existing FOI principles apply to them. The ICO's frameworks routinely surface in Kenyan, Nigerian and South African regulatory guidance within a few quarters of publication.
The NDPC hosted a two-day peer exchange in Abuja on 4 and 5 May 2026, bringing data protection regulators from nine African countries and multilateral institutions together to discuss cross-border enforcement coordination. Continental coordination among regulators has been discussed for years, but this meeting was distinguished by the enforcement position of the host: Nigeria convened the exchange while the Temu investigation, the CAC probe and the April advisory were all active, which made the session a working exchange of live case strategies rather than a general discussion. For organisations operating across multiple African jurisdictions, this points toward synchronised regulatory scrutiny, where an enforcement approach tested by one authority is more likely to be applied by its neighbours.
On 16 April 2026, the NDPC issued a data protection advisory directing all controllers and processors, including government ministries, to strengthen technical and organisational measures against escalating cyber threats: certified data protection officers, regular data protection impact assessments, multi-factor authentication, and NDPA 2023-grade security controls. The advisory followed the 1 April investigation notice and the Corporate Affairs Commission breach probe, and preceded further enforcement action.
The FSCA published a supervisory update on crypto asset service provider licensing on 15 April 2026, reporting 30 supervisory inspections of CASPs conducted between April 2025 and March 2026 under the Financial Advisory and Intermediary Services Act.
The website of Senegal's Commission des Données Personnelles returned on 12 April 2026 after an outage that began on 26 February, 45 days during which the authority had no working web presence.
The Central Bank of Nigeria inaugurated a Payments Service Providers Committee in Lagos on 2 April 2026, seating the CBN, commercial banks, mobile money operators and fintechs at one table, with a new Payments System Vision promised within a month. The scale being governed is considerable: Nigeria's digital payments system processed 11.2 billion transactions worth over one quadrillion naira in 2024.
CMA Rwanda set out a regulatory approach to the tokenisation of financial assets, presented at the Inclusive FinTech Forum in Kigali in early 2026: securities tokenisation, real-world asset tokenisation and tokenised funds, treated under the existing Capital Markets Act rather than a new statute. Formal tokenisation guidelines had not been published as at our coverage date.
On 1 March 2026, the National Bank of Ethiopia declared all birr-paired peer-to-peer cryptocurrency transactions illegal unless explicitly authorised, citing foreign exchange manipulation, fraud and the absence of anti-money laundering safeguards. The prohibition is drawn narrowly to birr-paired peer-to-peer transactions rather than digital assets generally, and authorisation is expressly contemplated: the NBE confirmed it is developing a comprehensive digital asset framework in consultation with global peer regulators. The ban follows Ethiopia's July 2024 reform programme and a roughly 200% birr devaluation, during which the NBE has been closing currency arbitrage channels, peer-to-peer crypto trading among them.
At the end of February 2026, the BCEAO circulated a questionnaire to fintech operators across the eight-state UEMOA zone on possible uses of cryptocurrencies in the regional financial system, reported by Jeune Afrique on 9 March. It is the central bank's first known crypto survey after years of restrictive silence.
Proclamation 1321/2024 carries penalties of up to 4% of turnover and prison terms, yet two years after its publication in the Federal Negarit Gazette, the ECA has issued none of its four planned implementing directives, opened no registration portal, and brought no enforcement action that could be identified. For controllers operating in Ethiopia, the preparation window remains open without a stated timeline.
Enforcement decisions, new laws and regulatory movement across African jurisdictions, in one brief. Free, and built to be forwarded to the colleague who needs it.
Your address goes to our email service provider and is used to send you the Digest, nothing else. Unsubscribe in one click, in every issue. Privacy policy. This site itself sets no cookies.