• NDPC convenes 9 African countries in Abuja (May 4–5, 2026) for data protection peer exchange

• Meeting brings together ECOWAS, CEMAC, IGAD and partners including World Bank and Smart Africa

• Over 30 African countries now have data protection laws, but enforcement capacity remains uneven

Nigeria is hosting a two-day cross-regional data protection peer exchange in Abuja from 4–5 May 2026. The event brings together regulators from nine African countries alongside regional and multilateral institutions, as states move towards coordinated enforcement of data governance rules.

The Nigeria Data Protection Commission (NDPC) convened representatives from The Gambia, Burundi, Somalia, Sierra Leone, Liberia, Zambia, Malawi, Ethiopia and Kenya. The meeting also includes participation from ECOWAS, CEMAC and IGAD, as well as technical support from the World Bank and Smart Africa.

The engagement follows earlier cooperation activities in 2025, including a study visit involving data protection authorities from Botswana, Eswatini, Mozambique, Sierra Leone, Tanzania and The Gambia, organised with support from the African Union and the European Union.

The Abuja discussions focus on regulatory implementation beyond legislation, with emphasis on enforcement systems, compliance frameworks for data controllers and processors, and mechanisms for protecting data subjects across jurisdictions. This reflects the operational gap between countries that have enacted data protection laws and those still developing enforcement capacity.

Africa now has more than 30 countries with data protection laws, according to comparative legal databases such as Data Protection Laws of the World (updated March 2026). These frameworks include Nigeria’s Data Protection Act 2023, Kenya’s Data Protection Act 2019, and newer regimes in countries such as Sierra Leone and Malawi that are still in early implementation phases.

Despite this legal expansion, enforcement capacity remains uneven. Regulatory institutions differ in staffing levels, investigative authority, and operational independence, creating fragmented conditions for digital services operating across multiple markets. This is particularly relevant for sectors such as fintech, telecoms and e-commerce, which depend on cross-border data flows.

Nigeria’s framework is among the more structured in West Africa following the enactment of the Nigeria Data Protection Act in June 2023 and the establishment of the NDPC as the national regulator. The law is supported by the General Application and Implementation Directive issued in 2025, which outlines rules on data processing, cross-border transfers, breach notification and compliance requirements for data controllers of major importance.

The inclusion of ECOWAS, CEMAC and IGAD brings regional blocs into efforts to align data protection frameworks, as integration initiatives such as the AfCFTA expand into digital governance. The participation of the World Bank and Smart Africa provides technical and policy support to strengthen regulators’ institutional capacity.

The outcome of the Abuja meeting is expected by participants to feed into ongoing discussions on harmonized enforcement approaches and regional cooperation mechanisms for data governance across Africa’s digital economy.

By Cynthia Ebot Takang