GDPR = European regulation but Africa has local laws: Senegal CDP (2008 law), Nigeria NITDA (NDPR 2019), SA POPIA (2020). Critical 2026 compliance.
TL;DR
- Africa: CDP, NITDA, POPIA, ANPD.
- GDPR applicable if EU data processing.
- Sanctions: 1-100M XOF Africa, 4% revenue EU.
- Mandatory DPO above certain threshold.
2026 Africa laws
- Senegal : CDP law 2008-12 + 2025 decree
- Regulator: Personal Data Commission
- Sanctions: 1-100M XOF
- Mandatory DPO >250 employees
- Nigeria : NDPR + NDPB Act 2023
- Regulator: NDPC
- Sanctions: 2% revenue or 10M NGN
- SA : POPIA 2020
- Regulator: Information Regulator
- Sanctions: 10M ZAR + jail
- Ivory Coast : ARTCI law 2013
- Morocco : Law 09-08 + CNDP
- Tunisia : INPDP
- Kenya : ODPC (2019)
Compliance process
- Processing mapping
- Legal bases (consent, contract, legitimate interest)
- Processing register
- PIA (Privacy Impact Assessment) if risk
- Legal notices + policies
- Rights procedures (access, deletion, portability)
- DPO if required
- Security (encryption, MFA, logs)
- Breach notifications <72h
- Annual audits
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Common mistakes
- No processing register
- Uninformed consent (pre-checked boxes)
- No DPO or untrained DPO
- Minimal security (clear passwords)
- No user rights procedure
- International transfers without clauses
FAQ
Q: Real Africa sanctions?
A: Senegal CDP = 5+ sanctions 2024-25. SA POPIA = 50M ZAR Discovery fine 2024.
Q: Internal or external DPO?
A: External via firm possible <500 employees. Internal beyond.
Conclusion
2026 Africa GDPR and data protection: local laws + GDPR if EU = obligation. Active CDP, NITDA, POPIA, ANPD regulators. Structured process + DPO + security = sustainable compliance.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
