What to watch
- Ghana
A new Data Protection Bill, announced in March 2026, would bring AI systems, automated decision-making, deepfakes and cross-border transfers under formal oversight. A separate Emerging Technologies Bill is being developed. Neither had passed in the latest reports we found.
- Egypt
On a strict reading of the law, enforcement begins on 1 November 2026, one year after the Executive Regulations were issued. The Centre may treat the grace period as running to the end of 2026.
- South Africa
We have not found a final, adopted version of the AI policy as of the last check.
At a glance
| Country | Main law | Regulator | Data protection officer | Cross-border transfers | National AI policy |
|---|---|---|---|---|---|
| Ghana | Data Protection Act, 2012 (Act 843) | Data Protection Commission | Not required; certified supervisor expected for large controllers | No specific transfer rules in the current Act | National AI Strategy 2025–2035 (April 2026) |
| Nigeria | Nigeria Data Protection Act 2023 + GAID 2025 | Nigeria Data Protection Commission (NDPC) | Required for controllers of major importance | Adequacy, approved instruments, or specific grounds | National AI Strategy (September 2025) |
| Kenya | Data Protection Act, 2019 | Office of the Data Protection Commissioner (ODPC) | Optional | Proof of safeguards; consent for sensitive data | National AI Strategy 2025–2030 (March 2025) |
| Egypt | Personal Data Protection Law No. 151 of 2020 | Personal Data Protection Centre, under the Minister of Communications and Information Technology | Required, registered with the Centre | Equal protection plus a Centre licence | National AI Strategy 2025–2030 (January 2025) |
| South Africa | POPIA (Act 4 of 2013) | Information Regulator | Required: registered information officer | Substantially similar protection, or consent or contract | Draft National AI Policy (April 2026) |
Ghana
- Law
- Data Protection Act, 2012 (Act 843).
- Regulator
- Data Protection Commission
- Registration
- Data controllers must register with the Commission before processing personal data. Registration lasts two years and must then be renewed. Controllers not incorporated in Ghana register as an external company.
- Data protection officer
- Not required by the Act. Controllers may appoint a certified data supervisor, and the Commission expects large controllers (annual turnover of GHS 5 million or more, or 250 or more staff) to have one.
- Cross-border transfers
- Act 843 has no specific rules on transferring personal data out of Ghana. Foreign personal data processed in Ghana must be handled in line with the law of the country it came from.
- National AI policy
- National Artificial Intelligence Strategy (2025–2035), launched by President Mahama in April 2026. The Data Protection Commission and the Cyber Security Authority are expected to take a stronger role in AI governance.
- Watch
- A new Data Protection Bill, announced in March 2026, would bring AI systems, automated decision-making, deepfakes and cross-border transfers under formal oversight. A separate Emerging Technologies Bill is being developed. Neither had passed in the latest reports we found.
Sources
Nigeria
- Law
- Nigeria Data Protection Act 2023, signed into law in June 2023, with the General Application and Implementation Directive (GAID) issued on 20 March 2025. Together they form the governing framework.
- Regulator
- Nigeria Data Protection Commission (NDPC)
- Registration
- Controllers and processors "of major importance" must register with the NDPC in one of three tiers. The two higher tiers file an annual compliance audit return by 31 March.
- Data protection officer
- Required for controllers of major importance. The DPO may be an employee or engaged under a service contract.
- Cross-border transfers
- Allowed where the NDPC finds the destination adequate, or under an NDPC-approved instrument such as binding corporate rules or standard contractual clauses. Otherwise only on specific grounds, including informed consent, contract performance, legal claims and vital interests.
- National AI policy
- National Artificial Intelligence Strategy, published in September 2025 and led by the Federal Ministry of Communications, Innovation and Digital Economy, with NITDA as a key implementing body.
Sources
Kenya
- Law
- Data Protection Act, 2019, in force since 25 November 2019.
- Regulator
- Office of the Data Protection Commissioner (ODPC)
- Registration
- Controllers and processors must register with the ODPC; certificates last 24 months. Small entities (turnover under KES 5 million and fewer than 10 staff) are exempt, but health providers must register regardless of size.
- Data protection officer
- Optional. If one is appointed, their contact details must be published on the organisation's website and given to the ODPC.
- Cross-border transfers
- Tightly regulated: the controller or processor must give the Commissioner proof of appropriate safeguards. Sensitive personal data, which includes health data, needs the data subject's consent to leave Kenya. Other bases include an adequacy decision and necessity.
- National AI policy
- National AI Strategy 2025–2030, launched on 27 March 2025 under the Ministry of Information, Communications and the Digital Economy. There is no comprehensive AI law yet.
Sources
Egypt
- Law
- Personal Data Protection Law No. 151 of 2020. Its Executive Regulations (Ministerial Decision No. 816 of 2025) were issued on 1 November 2025 and made public on 25 December 2025, starting a one-year compliance period.
- Regulator
- Personal Data Protection Centre, under the Minister of Communications and Information Technology
- Registration
- Controllers and processors need a licence or permit from the Centre to collect, store, transfer or process electronic personal or sensitive data. The Centre has 90 days to decide; no answer counts as a refusal.
- Data protection officer
- Required. The DPO must be a competent employee registered on the Centre's DPO register.
- Cross-border transfers
- Prohibited unless the destination offers protection no lower than Egypt's and the transfer has a licence or permit from the Centre. Exceptions include the data subject's express consent, for example to provide medical care.
- National AI policy
- Second edition of the National AI Strategy (2025–2030), launched in January 2025 by the National Council for Artificial Intelligence.
- Watch
- On a strict reading of the law, enforcement begins on 1 November 2026, one year after the Executive Regulations were issued. The Centre may treat the grace period as running to the end of 2026.
Sources
South Africa
- Law
- Protection of Personal Information Act 4 of 2013 (POPIA). Most sections commenced on 1 July 2020, with compliance required from 1 July 2021.
- Regulator
- Information Regulator
- Registration
- Information officers must be registered with the Information Regulator. Some processing needs the Regulator's prior authorisation.
- Data protection officer
- Required in the form of an information officer, registered with the Regulator.
- Cross-border transfers
- Allowed only if the recipient is bound by a law, binding corporate rules or an agreement giving protection substantially similar to POPIA, or on grounds such as consent or the performance of a contract with the data subject.
- National AI policy
- Draft National Artificial Intelligence Policy published for public comment on 10 April 2026 by the Department of Communications and Digital Technologies, after Cabinet approval for consultation. Comments closed on 10 June 2026. The draft is not binding law.
- Watch
- We have not found a final, adopted version of the AI policy as of the last check.
Sources