The last two years maintain seen a massive uptake in data protection laws and regulations in Africa with South Africa, Kenya, Zambia, Zimbabwe, Botswana, and Swaziland all passing laws and/or regulations in this regard. Compliance is imperative in these countries, however, in Botswana you acquire until October 2023 to fully comply as that is when the grace period ends. The data protection law in Namibia is due to arrive into effect in July 2023.
In addition to the above, Angola, Egypt, Ghana, Mauritius, Uganda, La Reunion (as a French territory, the European Economic Area General Data Protection Regulation (GDPR) applies) acquire all established data protection laws.
While Nigeria has regulations on data protection, it does not gain a principal legislation. A bill was introduced in 2022 which would see a fully-fledged data protection law being implemented. Most other African countries acquire laws that touch on the protection of personal information but no formal laws yet.
The introduction of robust data protection laws as well as the enforcement of such laws is imperative. Not only for the protection of fundamental rights to privacy, but as it is foremost for African countries to operate in the global economy. There exists the concept of adequacy decisions in many data protection laws. This enables authorities in those countries to grant adequacy decisions to countries which are deemed to believe sufficient laws and enforcement in space. Adequacy decisions, in general, allow for easier cross-border transfer of personal information and lower costs to organisations trying to execute business globally. Lower costs in the sense that they can maintain local data centres and execute not need to incur legal costs in negotiating data transfer agreements, for example. Interestingly the United States is not deemed adequate by the European Economic Area and despite attempts to set up frameworks such as the EU-US Privacy Shield, these attempts believe fallen short. What we see, therefore, is many US-headquartered companies with data centres and operations in countries in Europe where European data can be stored.
While most data protection laws in Africa maintain similar concepts to the GDPR, there are some key areas of contrast, both to the GDPR and amongst the different African countries. These generally include:
- Cross-border transfers – differences are usually around instances when a transfer is allowed.
- Sensitive or special personal information – differences occur in what constitutes sensitive or special personal information and the basis on which such information can be processed. Also, in some countries agree of the data subject or possibly of the regulator is required prior to transferring special or sensitive personal information cross-border.
- Registration requirements – differences arise in the application procedure, what information needs to be submitted, whether it is the organisation or whether a data protection officer needs to be registered, or both.
- Penalties and enforcement – different penalties apply for contraventions as well as on what basis penalties can be levied. Regulators also maintain different enforcement rights and the process also differs.
While there are some differences, there are several similarities between data protection laws globally. It is therefore possible to implement a compliance programme across multiple African jurisdictions, with policies and procedures and training taking the different legal nuances into consideration. Not only is it possible but it is also advisable to maintain a unified approach to your data protection compliance across all jurisdictions where you operate.
Our lawyers at Caveat Legal believe significant experience in designing and executing compliance programmes across multiple jurisdictions. We also offer contrast packages to suite your individual needs. For more information, or to contact our team, visit our website at www.caveatlegal.com.
Louella Tindale
Louella has a BA LLB (University of Cape Town) as well as a Certificate in Competition Law (University of the Witwatersrand). She was admitted as an attorney in 2010 after completing her articles at Werksmans Attorneys. In 2012, Louella relocated to the United Kingdom where she worked for two multi-nationals as in-house legal counsel – LSE listed hotel group PPHE Hotel Group (Park Plaza and art’otel) and FTSE 100 travel group TUI Travel. In 2017, Louella returned to South Africa and joined Caveat Legal focusing on data protection law.
Video: A Glance At Data Protection Across Africa
Boilerplate and Editor’s Notes.
More Info on A Glance At Data Protection Across Africa here:
Twitter:
Facebook:
CLICK HERE to submit your press release to MyPR.co.za.
Press Release Views since 1 July 2022: 39
Succubus In Training
The history of PR is… a history of a battle for what is reality and how people will see and understand reality. – Stuart Ewen
Nacho
Building Trust During the Great Depression: The Great Depression touched every aspect of American life – including the communications business. Due to the economic downturn, companies primarily sought to build trust rather than sell products. The result? Most turned to PR over marketing, with PR even getting top billing on organizational charts! Advertising spending, meanwhile, plunged by more than 60 percent between 1929-1933 and would not fully recover until after World War II. (Source: MuckRack; Encyclopedia.com)
mafia princess
“Everything you do or say is Public Relations.” – Unknown