Published by MZIZI Africa | DataHub Africa Editorial

If you have spent time on this platform, you will have noticed something: Kenya dominates. Over 280 cases and growing, drawn directly from official ODPC determination PDFs and a rapidly developing body of High Court appeal and review jurisprudence. Coverage of other African jurisdictions, by contrast, is comparatively sparse.

This is not an editorial choice. It is a reflection of where African data protection enforcement infrastructure currently stands, and it is worth explaining honestly, because the gap between Kenya and the rest of the continent tells you something important about the state of data protection law in Africa.

Why Kenya has 280+ cases and most of Africa has close to zero

The Office of the Data Protection Commissioner publishes its determination documents as structured PDF files, openly accessible, free of charge, and indexed on its official website. Each determination contains the full reasoning of the Commissioner, the statutory provisions applied, the evidence considered, and the remedy ordered. This is not common in Africa.

The result is that Kenya has, inadvertently, built the most accessible and analytically rich body of data protection enforcement decisions on the African continent. DataHub Africa processes these directly from the source, which is why the Kenya section grows week by week.

Other African countries have data protection laws. Several have operational data protection authorities. What they do not yet have, or have not yet made publicly accessible in a structured, processable format, is an equivalent body of published enforcement decisions.

What exists elsewhere, and what we can access

South Africa is the second most developed data protection enforcement environment on the continent. The Information Regulator, established under the Protection of Personal Information Act (POPIA), has been active since 2021 and has issued enforcement notices and administrative fines against organisations. However, the Information Regulator publishes its enforcement actions primarily as media statements rather than full structured decisions. This means DataHub Africa can report on enforcement activity but cannot yet produce the kind of detailed legal analysis that the ODPC determination format makes possible in Kenya.

South African courts - accessible through SAFLII, the Southern African Legal Information Institute - are separately beginning to produce judgments that directly apply POPIA. These are available in full text and DataHub Africa will cover them as a separate stream of South African case law.

Uganda has the Data Protection and Privacy Act, 2019 and an operational Personal Data Protection Office. Court judgments are accessible through ULII, the Uganda Legal Information Institute. However, no enforcement determinations equivalent to Kenya's ODPC decisions have yet been published in an accessible format.

Ghana has the Data Protection Act, 2012 and a Data Protection Commission. Court judgments are accessible through GhaLII. As with Uganda, no structured enforcement determination database comparable to Kenya's is publicly available.

Nigeria enacted the Nigeria Data Protection Act in 2023 and has an active Nigeria Data Protection Commission. NigeriaLII is operational but currently indexes a limited volume of judgments. The NDPC has not yet established a public enforcement determination repository.

Tanzania, Rwanda, Zambia, Namibia, Botswana, Zimbabwe, Malawi, Mauritius and Seychelles all have court judgment databases accessible through SAFLII or AfricanLII. DataHub Africa will cover data protection cases from these jurisdictions as they emerge in those databases.

Francophone Africa - including Senegal (Commission de Protection des Données Personnelles), Cameroon (Commission des Droits de l'Informatique et des Libertés Publiques), Morocco (Commission Nationale de contrôle de la protection des Données à caractère Personnel), and Côte d'Ivoire - has multiple active data protection authorities, some with significant enforcement histories. Coverage is constrained by two factors: most enforcement decisions are published in French only, and the level of structured public accessibility varies significantly by country. DataHub Africa is working to develop francophone coverage as a dedicated editorial stream.

What this means for how to use DataHub Africa