The verdict in three sentences
There is no single African data law: each country imposes its own rules on residency, consent and appointing a DPO. In 2026, fines can reach 2% of turnover (or more under some regimes), and the localization of payment data is becoming a recurring control point. Processing card or mobile money means processing personal data — so you enter this legal scope.
Comparative table by country
The main regimes affecting an SME collecting payments. 2026 orders of magnitude.
| Country | Main law | Authority | Max sanction |
|---|---|---|---|
| Senegal | Law 2008-12 | CDP | Fine + criminal |
| Nigeria | NDPR / NDPA | NDPC | 2% of annual turnover |
| South Africa | POPIA | Information Regulator | ~R10M + criminal |
| Kenya | DPA 2019 | ODPC | up to 5M KES |
| Côte d'Ivoire | Law 2013-450 | ARTCI | Fine + criminal |
| Ghana | DPA 2012 | DPC | Fine + criminal |
The common thread: explicit consent, clear information, and often a declaration or registration with the authority.
Payment compliance checklist
What an SME needs in place to process payment data with confidence.
| Requirement | Detail |
|---|---|
| Consent | Un-pre-ticked box, clear purpose |
| Minimization | Store only what is strictly needed |
| Localization | Check whether data must stay in-country |
| DPO | Appoint a lead if high volume |
| Security | Encryption, tokenization, restricted access |
| Processors | Contract with the aggregator (DPA) |
| Rights | Access, rectification, deletion |
| Breach notice | Alert the authority within 72h often |
Tokenization helps on two fronts: it reduces the PCI-DSS scope and minimizes the personal data kept.
Mini case study
Fatou runs an online store in Dakar that also sells to Nigeria. She falls under Law 2008-12 (CDP declaration) and Nigeria's NDPA for her Nigerian customers. By outsourcing card handling to an aggregator (minimized data) and adding a clear consent banner, she covers the essentials without storing a number — avoiding an NDPA fine that could reach 2% of her Nigerian turnover.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Does mobile money fall under these laws?
Yes: phone number, identity and history are personal data. That it is not a card does not remove you from data law.
Must I host my data in Senegal?
Law 2008-12 governs transfers out of the country; some flows require CDP authorization. Check case by case, especially for foreign cloud hosting.
What is a DPO and when to appoint one?
A data protection officer. It becomes recommended, even required, once you process a large volume or sensitive data.
What concrete sanctions in 2026?
They range from administrative fines (up to 2% of turnover under regimes like the NDPA) to criminal prosecution and an order to stop processing.
Does selling to several countries complicate everything?
Yes: you stack the regimes of each country where your customers reside. Data minimization and a compliant aggregator greatly simplify the burden.
Let's talk about your project. We design a minimized checkout, compliant consent and a data architecture aligned with your market. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
