As of April 2026, 44 of the 54 African Union member states had enacted data protection legislation and 37 had an operational data protection authority, according to the CIPIT dashboard at Strathmore University. The continental treaty is thinner: the African Union's own list, dated 8 July 2024, shows 16 ratifications among 55 states.
How many African countries have a data protection law?
The Center for Intellectual Property and Information Technology Law (CIPIT) at Strathmore University maps all 54 African Union member states and says 44 have enacted data protection legislation, as of April 2026. Seven countries have no general data protection law. The dashboard does not break out the remaining three in its summary text, so treat the 44 and 7 as the figures it states, not as a sum to 54.
CIPIT is a research center, not a regulator, and its dashboard is a living page that it revises. Cite it with its April 2026 date. The African Union's own treaty list counts 55 states and includes the Sahrawi Arab Democratic Republic as an entry, so the two sources use different denominators.
For the global picture, see our count of how many countries have data protection laws, and our privacy laws by country overview for the other regions.
Roughly four in five African Union states now have a data protection statute on the books.
How many African states have a working regulator?
A law with no enforcer is a weaker signal, and CIPIT counts both. It reports 37 countries with operational data protection authorities and says 17 lack "fully operational" enforcement bodies. That 17 is the gap between having a statute and having someone who can act on it.
The dashboard also tracks the regional instruments that sit behind national laws: the AU Data Policy Framework, the ECOWAS Supplementary Act on Personal Data Protection, and the SADC Model Law on Data Protection. The ECOWAS act is a good example of how regional text pushed national regulators into existence. Adopted in Abuja on 16 February 2010, its Article 14 says each member state shall establish its own data protection authority and that the authority shall be an independent administrative authority.
Operational regulators reach 37 states, so enforcement capacity, not legislation, is the bigger remaining gap.
What is the Malabo Convention, and how many states have ratified it?
The African Union Convention on Cyber Security and Personal Data Protection, known as the Malabo Convention, was adopted at the Assembly's Twenty-third Ordinary Session in Malabo, Equatorial Guinea, on 27 June 2014. Article 36 provides that it enters into force 30 days after the Chairperson of the AU Commission receives the 15th instrument of ratification. The AU's status list, dated 8 July 2024, records 21 signatures, 16 ratifications and 16 deposits among 55 states.
Figure 1: Selected African data protection milestones. Source: ECOWAS Supplementary Act A/SA.1/01/10; South Africa Government Gazette No. 37067; African Union Convention text and status list; CIPIT dashboard (April 2026).
The treaty and the national laws are separate tracks. A country can pass a national statute without joining the Convention, and the figures show many have. That is why 44 national laws sit beside only 16 ratifications.
Ratification is a government's choice, and for most of the continent it has not happened yet.
How were the Malabo ratifications spread over time?
Sorting the 16 deposit dates in the AU list gives one deposit in 2016 (Senegal), two in 2018, three in 2019, three in 2020, two each in 2021, 2022 and 2023, and one in 2024 (Sao Tome and Principe). On that ordering, Cote d'Ivoire's April 2023 deposit was the 14th, Mauritania's of 9 May 2023 was the 15th, and 30 days later is 8 June 2023.
Figure 2: Cumulative ratification deposits by year, counted from the dates in the AU's status list of 8 July 2024. The count passes the Article 36 threshold of 15 in 2023.
The pace was about two deposits a year, and the treaty took nine years from adoption to cross its threshold. The deposit count ends at 16 only because the latest list available to us is dated July 2024. Check the AU treaty database for later deposits before quoting a current total.
The Convention entered into force only after nine years of slow, steady deposits.
Which African countries have signed but not ratified?
Counting the AU's rows gives three groups among its 55 states. Sixteen have ratified or acceded, of which 8 also show a signature date. Thirteen have signed without ratifying, and 26 have done neither.
Figure 3: Malabo Convention status of the 55 states on the AU list dated 8 July 2024, grouped by our count of its signature and ratification columns. "Ratified" includes accession. Source: African Union, list of countries which have signed, ratified or acceded.
South Africa signed on 16 February 2023 and Nigeria on 23 January 2024, and neither shows a ratification date. Egypt, Kenya, Ethiopia, Algeria, Morocco, Tanzania, Uganda and Zimbabwe show no signature or ratification at all. That says nothing about their national laws, because the treaty list records only treaty action and a country can legislate at home without joining.
A business serving users in several African countries should read the national law first and treat the Convention as background.
What do national laws actually say about penalties?
Two statutes are worth reading directly. Nigeria's Data Protection Act 2023 establishes the Nigeria Data Protection Commission, and section 48 lets it make enforcement orders, including a penalty or remedial fee. The "higher maximum amount," for a controller or processor of major importance, is the greater of N10,000,000 or 2% of annual gross revenue in the preceding financial year. The "standard maximum amount" is the greater of N2,000,000 or 2% of the same revenue.
South Africa's POPIA was assented to on 19 November 2013. According to the government's commencement table, sections 2 to 38 and 55 to 109 commenced on 1 July 2020, and sections 110 and 114(4) on 30 June 2021. Section 109 allows the Regulator to issue infringement notices with an administrative fine that may not exceed R10 million, and section 107 provides imprisonment of up to 10 years for the most serious offenses.
Ghana is the third example. Its Commission is "an independent statutory body established under the Data Protection Act, 2012 (Act 843)" and its register is mandatory: the Commission's site says all data controllers and processors must register. Ghana also ratified the Malabo Convention, with its instrument deposited on 3 June 2019.
| Country | Law | Penalty or key fact | Malabo status |
|---|---|---|---|
| Nigeria | Data Protection Act 2023 | Greater of N10,000,000 or 2% of annual gross revenue (higher cap) | Signed 23 January 2024 |
| South Africa | POPIA (Act 4 of 2013) | Administrative fine up to R10 million; up to 10 years for serious offenses | Signed 16 February 2023 |
| Ghana | Data Protection Act 2012 (Act 843) | Mandatory registration of controllers and processors | Ratified, deposited 3 June 2019 |
| 44 of 54 AU states | National data protection law | 37 have an operational authority (CIPIT, April 2026) | 16 of 55 ratified (AU list, July 2024) |
Source: statutes and regulator pages cited below. This is a summary of three laws, not legal advice, and the penalty figures are statutory maximums, not typical outcomes.
Nigeria ties its caps to revenue, while South Africa sets a fixed ceiling.
How do the layers fit together?
Across the continent, a privacy question has up to three layers: a national statute, a regional instrument, and the continental treaty. A service with African users reads the national layer first because that is where fines and registration duties live. For the neighboring regions, see our trackers for Southeast Asia and the Gulf states.
Figure 4: A reading order for African privacy obligations, using the 44 and 7 figures from the CIPIT dashboard (April 2026). This is a research aid, not a compliance test.
The Convention appears last because only 16 states had ratified it by July 2024, so a national statute is far more likely to bind you directly.
National law comes first, regional and continental texts come second.
The Bottom Line
Africa has nearly three times as many national data protection laws as ratifications of its continental treaty: 44 of 54 states have a statute, while 16 of 55 had ratified the Malabo Convention by July 2024. Enforcement capacity trails legislation, with 37 operational authorities and 17 states that lack a fully operational one. The penalty regimes that exist are meaningful: up to N10,000,000 or 2% of revenue in Nigeria, and up to R10 million in South Africa. If your site or app reaches users in Africa, publish a privacy policy that names what you collect, why, and who receives it. You can generate a privacy policy as a starting point, and have it checked against the national law of each country where you have users. Laws and dashboards move, so re-check the CIPIT page and the AU treaty database before you rely on any count.
Frequently Asked Questions
How many African countries have a data protection law? 44 of the 54 African Union member states had enacted data protection legislation as of April 2026, according to the CIPIT dashboard at Strathmore University. Seven have no general data protection law.
How many African countries have an operational data protection authority? 37 of the 54 states maintain an operational data protection authority, per the same April 2026 CIPIT dashboard. A further 17 lack a fully operational enforcement body.
Has the Malabo Convention entered into force? Yes. Article 36 sets entry into force 30 days after receipt of the 15th instrument of ratification. The African Union's list shows the 15th deposit on 9 May 2023 and a 16th on 15 February 2024, out of 55 states listed on 8 July 2024.
What is the maximum penalty under Nigeria's data protection law? The Nigeria Data Protection Act 2023 caps a penalty at the greater of N10,000,000 or 2% of annual gross revenue for controllers of major importance, and the greater of N2,000,000 or 2% for others.
Where the Numbers Come From
- CIPIT, Strathmore University: Data Governance Across Africa, Mapping of Data Protection Laws (April 2026). 54 states, 44 with legislation, 37 operational authorities, 7 with no general law, 17 without fully operational enforcement bodies.
- African Union: List of countries which have signed, ratified or acceded to the Convention on Cyber Security and Personal Data Protection (8 July 2024). 55 states, 21 signatures, 16 ratifications and deposits, adoption on 27 June 2014. The groupings and yearly counts in this post are our own tallies of its rows.
- African Union: Convention on Cyber Security and Personal Data Protection (text). Article 36, entry into force after the 15th instrument of ratification.
- ECOWAS: Supplementary Act A/SA.1/01/10 on Personal Data Protection within ECOWAS (16 February 2010), copy hosted by Statewatch. Article 14, national data protection authorities.
- Government of South Africa: Protection of Personal Information Act 4 of 2013 (Government Gazette No. 37067). Assent on 19 November 2013, sections 107 and 109.
- Government of South Africa: Protection of Personal Information Act, commencement table. Commencement on 1 July 2020 and 30 June 2021.
- Federal Republic of Nigeria: Nigeria Data Protection Act, 2023 (copy hosted by Policy and Legal Advocacy Center). Part X, section 48, higher and standard maximum amounts.
- Data Protection Commission, Ghana. Act 843 of 2012 and mandatory registration.
Note: All figures verified as of November 2026. UNCTAD's tracker could not be retrieved for this update, so country counts rest on the CIPIT dashboard, and the Malabo status list is the latest we could retrieve (8 July 2024).
