DATA PROTECTION DIGEST

Archive · Legislation

Legislation: archive

All 11 archive entries filed under legislation, most recent first.

ZA · LEGISLATION

South Africa gazettes draft Capital Flow Management Regulations, crypto included for the first time

The National Treasury published the Draft Capital Flow Management Regulations 2026 for public comment in April 2026, replacing the Exchange Control Regulations of 1961 and bringing crypto assets formally within South Africa's capital flow framework for the first time.

18 April 2026 · Legislation · Crypto & digital assets
NG · LEGISLATION

SEC Nigeria proposes a N7.5 billion capital floor for free trade zone entities

SEC Nigeria issued a rules exposure draft on 14 April 2026 setting a minimum paid-up share capital of N7.5 billion for Free Trade Zone Entities seeking to offer or issue shares on the Nigerian capital market, with a two-week comment window through the Rules Committee. Nigeria's free trade zones host technology, digital payments and blockchain infrastructure operators, and a N7.5 billion capital floor for public market access determines which of them can raise capital domestically and which must structure offshore.

14 April 2026 · Legislation · Crypto & digital assets
KE · LEGISLATION

Public consultation on Kenya's VASP Regulations closes; final rules expected Q2

Public participation on the Draft Virtual Asset Service Providers Regulations 2026 closed on 10 April 2026, keeping Kenya on track to operationalise VASP licensing in 2026.

10 April 2026 · Legislation · Crypto & digital assets
ZA · LEGISLATION

Treasury moves to bring crypto transfers inside South Africa's exchange control regime

South Africa's National Treasury confirmed it will amend the Exchange Control Regulations to govern transfers of cryptocurrency to non-residents, according to an April 2026 analysis published on Polity.

KE · LEGISLATION

Kenya publishes draft VASP Regulations for public consultation

The National Treasury published the Draft Virtual Asset Service Providers Regulations 2026 for public consultation on 17 March 2026, the first implementing instrument under the VASP Act 2025. Developed with the CBK and CMA through a multi-agency task force and accompanied by a Regulatory Impact Statement, the draft sets out licensing and authorisation processes for all VASP categories, from exchanges to custodial wallets to payment processors, and incorporates FATF Recommendation 15 and Travel Rule requirements.

17 March 2026 · Legislation · Crypto & digital assets
GH · LEGISLATION

Ghana enacts its VASP Act, the third African market to legislate on crypto in 2025

Ghana's Virtual Asset Service Providers Act passed Parliament on 19 December 2025 and received presidential assent on 30 December, the third African market to pass major crypto-relevant legislation in 2025, after Nigeria's Investments and Securities Act 2025, which brought digital assets within securities regulation, and Kenya's standalone VASP Act 2025. The Bank of Ghana and SEC Ghana share the regulatory mandate under the Act, all virtual asset service providers must be licensed, and the law extends to Ghana's large informal crypto market.

30 December 2025 · Legislation · Crypto & digital assets
ET · LEGISLATION

Ethiopia's data protection law turns one with no implementing directives in force

A year after Ethiopia enacted the Personal Data Protection Proclamation No.

November 2025 · Legislation
KE · LEGISLATION

Kenya's VASP Act in force: existing operators have until 4 November 2026

Kenya's Virtual Asset Service Providers Act 2025 was assented on 15 October 2025 and came into force on 4 November 2025, making Kenya one of East Africa's first jurisdictions with a standalone virtual asset statute. Supervision under the Act splits between the CBK, which covers issuance and custodial services, and the CMA, which covers exchanges, brokers and trading platforms.

4 November 2025 · Legislation · Crypto & digital assets
NG · LEGISLATION

The GAID takes effect: Nigeria's operating manual for the NDPA

The NDPC's General Application and Implementation Directive 2025 (GAID), issued 20 March 2025 and effective from 19 September 2025, is the instrument that converts the Nigeria Data Protection Act 2023 into day-to-day compliance obligations: registration, lawful bases, data subject rights, cross-border transfer rules and enforcement mechanics. The GAID sets a materially higher bar than the NITDA-era framework it replaced.

20 March 2025 · Legislation
ET · LEGISLATION

Ethiopia: still a law without machinery

Proclamation 1321/2024 carries penalties of up to 4% of turnover and prison terms, yet two years after its publication in the Federal Negarit Gazette, the ECA has issued none of its four planned implementing directives, opened no registration portal, and brought no enforcement action that could be identified. For controllers operating in Ethiopia, the preparation window remains open without a stated timeline.

24 July 2024 · Legislation · Guidance & policy