Category
🗞
NewsTranscript
00:00Nigeria and Kenya were at the forefront of data privacy enforcement in the year 2024.
00:05That's according to Yellowcard's 2025 report on data protection in Africa, highlighting
00:10that 39 out of 55 African countries have implemented data protection laws, a significant step towards
00:16creating a more secure digital environment.
00:19Looking ahead, the Pan-African FinTech Company notes that the increased focus on cross-border
00:24data flows, along with a concerted effort to protect children's online safety, are
00:29likely to be key areas of growth and transformation this year.
00:32Thelma Okoriye, the Group Data Protection and Privacy Council at Yellowcard, joins me
00:37now to unpack the report and their key predictions for the continent.
00:42Thank you so much for your time today, Thelma.
00:43I hope I did a good job with running through the overview of the key findings there.
00:48But I'd like to get your input here as well and talk about some of the key takeaways from
00:51your research and which trends you would say stand out the most.
00:57Thank you very much.
00:59The report was basically an overview of what we have in the African data protection landscape.
01:05And like you rightly said, about 39 out of 55 have data protection laws, with 34 of those
01:12countries which have enacted data protection authorities.
01:18So over the past decade, data protection has changed significantly as the continent becomes
01:24more connected to the global digital economy.
01:28Countries and individuals have seen the need and the necessity of having privacy laws to
01:33protect data of individuals.
01:37Now because of this connectivity, we have to ensure that there's awareness and the ability
01:42to protect data.
01:44But however, unlike what we find in the European space, which is the GDPR, the General Data
01:51Protection Regulation, that covers the whole of Europe, Africa tends to have a fragmented
01:57approach with each country having its own laws.
02:00So you find that when investors want to come to Africa, or companies that have multiple
02:07branches in different African continents, they have multiple laws to contend with.
02:12So there's the different countries, Nigeria has its own data protection law, Kenya has
02:18its own, South Africa has its own, and you find that there's like slight differences
02:23in these laws, which make it a bit more complex to comply with, as opposed to a company that's
02:30operating in Africa.
02:33And what we also see is things like cross-border data transfers, which means transferring data
02:39from one country to another.
02:42You also find that there's some laws that need, differences in the laws that need to be
02:49complied with, because each country says that you need to only send the law, or send the
02:55data to a country that has similar or adequate laws.
02:58So if a country, if country A has lesser protection for personal data, you find that it's harder
03:06to send data to that country, thereby impeding business flow or flows between the, between
03:15organization or branches of organizations.
03:18Another thing that we noticed in the 2025 report is like you said, sector specific regulations.
03:25Now this means that countries are tending towards bringing out laws for each sector.
03:31So something like the healthcare sector that deals with really sensitive data, they have
03:36higher restrictions and higher compliance levels.
03:40Also finance, financial information are also, they also have a higher threshold of protecting
03:48the data in their, in their records.
03:51Tell me, for the countries that are doing quite well, you mentioned Kenya, Nigeria,
03:56in terms of data privacy enforcement here, what would you say are some of the specific
04:01actions these countries are taking that sets them apart, and what can other countries learn
04:05from that experience?
04:06Sorry, could you repeat that?
04:10What would you say are some of the specific actions countries like Kenya and Nigeria are
04:14taking that sets them apart, and what can other countries learn from their approach?
04:20Okay.
04:21So a big thing that you find with Nigeria and Kenya is enforcement.
04:26Now it's one thing to have the laws, it's another thing to enforce these laws.
04:30And because Nigeria and Kenya and also South Africa have taken the additional step of starting
04:38to enforce the laws.
04:40Like last year, you see that Nigeria fined META for breaching data protection laws of
04:49Nigerian residents.
04:50There was this whole not having consent, and basically not complying with the data protection
04:54laws applicable in Nigeria.
04:57So it was said that META was giving the European nations a higher threshold of protection than
05:02what was applicable in Nigeria, and there was a huge fine on META for that.
05:07But you also see that Kenya also fines companies that also breach data protection laws.
05:12So you find that when there's enforcement in place, it encourages people to comply and
05:19it increases investors' trust in the country that they are working with.
05:25So because if there's no enforcement, there's basically no need for the law because it has
05:29to be in place for people to comply and protect the data of their citizens.
05:33All right, because now my next question to you is a bit tricky, because when you look
05:37at the lay of the land, we're definitely going to see increasing cross-border data flows
05:42happen.
05:43There's no way to stop that.
05:44The world is evolving in that direction.
05:46But how should African regulators on the one hand then balance data sovereignty on one
05:52hand with foster innovation in the midst of cross-border trade?
05:58Yeah, that's definitely a tricky question.
06:02It's even something that is being considered right now in Nigeria and other African countries.
06:07We see countries like Algeria have enacted some similar, some sense of data sovereignty
06:13requiring their laws to remain within their borders.
06:17Now, anything, once you hear data sovereignty, you know it's going to basically seem like
06:24an impediment to the innovation and flow or free flow of business and free flow of information.
06:31Because most companies and most international companies that come to the country or come
06:36to Africa to invest expect to be able to basically process their data in maybe one place for
06:44ease of doing business.
06:46So if you have a country that has multiple branches in different continents or different
06:50regions, most times they have like a dedicated office that processes the data that they use
06:56in the business.
06:57Now, meaning that they need to be able to mine data out of whichever country they're
07:01investing in and take it to where they need to process it.
07:05So for balance, we can say that we understand some data is quite sensitive, maybe things
07:13dealing with national security, things that have to do with government data, things that
07:18have to do with, that will affect the economy of the nation.
07:22So those kind of data can be mandated to be stored within the country.
07:28But when it comes to maybe personal data of customers, that can, now we can strike the
07:34balance and say, okay, that can also leave the borders, but ensure that wherever it's
07:39going to, it has adequate protection and the data will not be subject to unnecessary hacks.
07:45It will be secure, it will be confidential.
07:49So that's a good way of striking a balance between innovation and data sovereignty.
07:53All right.
07:54Thank you so much for that input today.
07:55Thelma Onkori, there's the Group Data Protection and Privacy Council at Yellowcard.