| Law | Protection of Personal Information Act (POPIA) | Data Protection Act, 2019 | Nigeria Data Protection Act (NDPA), 2023 | Data Protection and Privacy Act, 2019 | Personal Data Protection Act, 2022 | Law No. 058/2021 | Data Protection Act, 2021 | Data Protection Act, 2024 |
|---|
| In force | July 2021 (most provisions from July 2020) | November 2019 | June 2023 | May 2019 (regulations March 2021) | May 2023 | October 2021 (full compliance October 2023) | April 2021 | June 2024 |
|---|
| Regulator | Information Regulator | Office of the Data Protection Commissioner (ODPC) | Nigeria Data Protection Commission (NDPC) | Personal Data Protection Office (PDPO) | Personal Data Protection Commission (PDPC) | National Cyber Security Authority (NCSA) | Office of the Data Protection Commissioner | Malawi Communications Regulatory Authority (MACRA) |
|---|
| Registration | Register your Information Officer with the Regulator | Mandatory above thresholds, and in certain sectors, with the ODPC | Controllers and processors of major importance register with the NDPC | Every data collector, processor and controller registers with the PDPO | Collectors and processors register with the PDPC | Controllers and processors register with the NCSA | No one may act as a controller or processor without registering | Controllers and processors of significant importance register with MACRA |
|---|
| Data protection officer | Information Officer required for every organisation | May be designated; relevant for public bodies, large-scale monitoring and sensitive data | Mandatory for controllers of major importance | A DPO must be designated by the head of the institution | A DPO must be appointed | Required in certain cases (large-scale monitoring or sensitive data) | A DPO must be appointed, under the Commissioner's guidelines | Required for public authorities, and for large-scale monitoring or sensitive data |
|---|
| Breach notification | As soon as reasonably possible, to the Regulator and data subjects | Within 72 hours to the ODPC; data subjects within a reasonably practical period | Within 72 hours to the NDPC; data subjects immediately where high risk | Immediately, to the PDPO | Promptly, to the PDPC | Within 48 hours to the NCSA | Within 24 hours to the Commissioner; data subjects as soon as practicable | Within 72 hours to MACRA |
|---|
| Penalties | Administrative fines up to ZAR 10 million; up to 10 years' imprisonment for listed offences | Up to KES 5 million or 1% of annual turnover, whichever is lower; offences: up to KES 3 million and/or 10 years | Major importance: greater of NGN 10 million or 2% of annual gross revenue; others: greater of NGN 2 million or 2% | Up to about UGX 4.8 million and/or 10 years for listed offences | Penalty notices up to TZS 100 million; companies up to TZS 5 billion; individuals up to TZS 20 million and/or 10 years | Administrative fines of RWF 2 to 5 million or 1% of global turnover; corporate criminal fines of 5% of annual turnover | Corporate bodies: greater of 100 million penalty units or 2% of annual turnover; individuals up to 1 million penalty units and/or 5 years | Administrative penalties up to MWK 20 million; ignoring a compliance order: MWK 20 million and up to 5 years |
|---|
| Open briefing → | Open briefing → | Open briefing → | Open briefing → | Open briefing → | Open briefing → | Open briefing → | Open briefing → |
|---|
South AfricaProtection of Personal Information Act (POPIA)Read the briefing 
KenyaData Protection Act, 2019Read the briefing 
NigeriaNigeria Data Protection Act (NDPA), 2023Read the briefing 
UgandaData Protection and Privacy Act, 2019Read the briefing 
TanzaniaPersonal Data Protection Act, 2022Read the briefing 
RwandaLaw No. 058/2021Read the briefing 
ZambiaData Protection Act, 2021Read the briefing 
MalawiData Protection Act, 2024Read the briefing 
