• 45 African countries enacted data protection laws, while 16 adopted national AI strategies.
• 39 countries now operate fully functional data protection authorities.
• Enforcement remains uneven, despite rising regulatory crackdowns in key markets.

Africa has accelerated the adoption of binding frameworks on data protection and artificial intelligence, but uneven regulatory maturity and enforcement capacity continue to shape the continent’s digital landscape, according to a report released on April 23 by Yellow Card.

The report, titled “Data protection and AI governance in Africa,” shows that Africa has made significant progress over the past decade in regulating personal data, as governments responded to rising digitalization, cross-border data flows and platform-based services.

A total of 45 African countries enacted data protection laws by end-2025, and 39 countries established fully operational regulatory authorities. However, regulatory maturity and enforcement capacity remain uneven, reflecting disparities in institutional resources and digital readiness.

More advanced digital economies, including Nigeria, Kenya, South Africa, Ghana and Rwanda, now prioritize stricter enforcement, cybersecurity resilience and accountability in high-risk data processing.

Authorities across several jurisdictions have stepped up enforcement actions. In Uganda, a court sentenced the director of an online lending platform to prison for failing to register with the data protection office and for unlawfully processing personal data without consent.

In Kenya, the Office of the Data Protection Commissioner imposed fines for unlawful data retention and unauthorized processing. Meanwhile, Nigeria’s Data Protection Commission published a list of more than 1,300 organizations under investigation for non-compliance, signaling stronger regulatory intent.

However, weaker or emerging regulatory frameworks in some jurisdictions continue to expose individuals to risks and create operational complexity for companies operating across multiple African markets.

The report highlights several 2025 milestones, including new data protection laws in Djibouti, Gambia and Algeria. Authorities also became operational in Malawi, Togo and Republic of the Congo, while regulators issued compliance guidelines in Nigeria, Zimbabwe, Uganda and Tanzania.

Convergence between data protection and AI governance

Governments across Africa have adopted divergent priorities in AI governance. National strategies in Kenya, Ivory Coast, Zambia, Egypt and Cameroon emphasize infrastructure, skills development, ethical deployment and institutional oversight.

Meanwhile, draft AI legislation in Angola, Nigeria, Morocco and Namibia signals a shift toward binding regulatory regimes.

Overall, 16 countries have adopted national AI strategies or policies that prioritize innovation and capacity building over strict regulation. Governments have relied on policy frameworks and non-binding instruments to build local capabilities, attract investment and manage risks through existing data protection and cybersecurity laws.

However, rapid AI deployment, combined with stronger data protection regimes and global regulatory influence, will likely push many African countries toward enforceable AI governance frameworks in the medium term.

The report identifies a key structural shift in Africa’s digital economy: the growing convergence between data protection and AI governance.

Recent initiatives illustrate this trend. Rwanda signed a trilateral memorandum of understanding with the United Arab Emirates and Malaysia to collaborate on AI governance, skills development and ethical innovation. Kenya also partnered with the European Union, GIZ and the African Union to develop a national data strategy and policy framework.

These developments indicate that 2026 will bring stricter enforcement, greater institutional maturity and deeper integration between data protection and AI governance across Africa.

Against this backdrop, companies must proactively embed “privacy-by-design” principles and ethical AI into their infrastructure to sustain digital ecosystems, mitigate risks and maintain user trust, the report said.

This article was initially published in French by Walid Kéfi

Adapted in English by Ange J.A de Berry Quenum