READING LIST
Module X:Data Protection in Practice: East
African and African Perspectives
East African National Data Protection Laws and Regulations
NATIONAL LAWS
Kenya
Kenya, Constitution of Kenya 2010, Article 31 on privacy, and Data Protection Act 2019.
Available at [Link]. The domestic anchor for Kenyan data protection practice;
these are what the continental instruments ultimately inform.
Data Protection Act, No. 24 of 2019 (Kenya Law Reports).
<[Link]
Data Protection (General) Regulations, 2021, Legal Notice No. 46 (Regulations 40–48 on
cross-border transfers). <[Link]
[Link]>
The Data Protection (Registration of Data Controllers and Data Processors) Regulations,
2021 <[Link]
PROTECTION-REGISTRATION-OF-DATA-CONTROLLERS-AND-DATA-PROCESSORS-
[Link]>
The Data Protection (Complaints Handling and Enforcement Procedures) Regulations,
2021 <[Link]
[Link]>
Uganda
Data Protection and Privacy Act, 2019.
<[Link] >
Data protection and privacy regulations, 2021.
<[Link]
[Link]>
Tanzania
Personal Data Protection Act, 2022. <
[Link]
The Personal Data Protection (Personal Data Collection and Processing) Regulations,
2023. <[Link]
GN%20NO.%20449C%20OF%[Link]>
Rwanda
Law No. 058/2021 of 13/10/2021 Relating to the Protection of Personal Data and Privacy.
<[Link]
_the_protection_of_personal_data_and_privacy.pdf>
Ethiopia
Personal Data Protection Proclamation (PDPP).
<[Link]
Somalia
Data Protection Act, 2023.
<[Link]
AFRICAN DATA PROTECTION FRAMEWORKS
African Union Instruments
African Commission on Human and Peoples' Rights, Declaration of Principles on Freedom
of Expression and Access to Information in Africa, 2019. Available at [Link].
Interprets Article 9 of the African Charter; Principles 40 to 42 set out privacy, personal
information, anonymity and surveillance standards.
African Union Continental Artificial Intelligence Strategy, July 2024. Available at
[Link]/en/documents/20240809/continental-artificial-intelligence-strategy. Frames data
protection as a prerequisite for rights-respecting AI; adopted at the 45th Ordinary
Session of the AU Executive Council, Accra.
African Union Convention on Cyber Security and Personal Data Protection (Malabo
Convention), 2014. Available at [Link]. The foundational binding continental instrument;
entered into force 8 June 2023.
African Union Data Policy Framework, 2022. Available at
[Link]/en/documents/20220728/au-data-policy-framework. The non-binding continental
policy architecture complementing Malabo; foregrounds data protection as the
"backbone" of any data system.
African Union, Digital Transformation Strategy for Africa 2020-2030. Available at
[Link]/en/documents/20200518/digital-transformation-strategy-africa-2020-2030. The
continental master digital plan; contains the Malabo alignment action widely read as a de
facto 2030 harmonisation target.
Regional Instruments
East African Community, EAC Data Governance Policy Framework, validated October
2024. EAC Secretariat press release at [Link]/press-releases. The most important recent
regional development for East Africa; moves the EAC toward binding harmonisation.
ECOWAS, Supplementary Act A/SA.1/01/10 on Personal Data Protection within
ECOWAS, 2010, and 2024 revision process. ECOWAS press releases at [Link]. The
only binding sub-regional data protection instrument in Africa; the revised Act was
validated at expert level in Accra, November 2024.
Additional Readings
Calvin Mulindwa, ‘A Comparative Perspective On Privacy Safeguards in Kenya and
Uganda Data Protection Laws’ [2026], CIPIT <[Link]
comparative-perspective-on-privacy-safeguards-in-kenya-and-uganda-data-protection-
laws/>.
Calvin Mulindwa, ‘Cross-Border Data Flows in Africa: Exploring Legal Frameworks and
Regional Importance’ (CIPIT 14, 2024) <[Link]
flows-in-africa-exploring-legal-frameworks-and-regional-importance/>.
CIPIT, The African Union Convention on Cyber Security and Personal Data Protection:
Key Insights, 2023. Available at [Link]
convention-on-cyber-security-and-personal-data-protection-key-insights/ Africa-centred
analysis of Malabo's ratification, scope and enforcement challenges.
Deo Shao, Fredrick Ishengoma, Anastasija Nikiforova, Mrisho Swetu, ‘Comparative
Analysis of Data Protection Regulations in East African Countries’ [2024] Digital Policy
Regulation and Governance
<[Link]
data-protection>.
Digital Policy Alert and Tech Hive Advisory, The Year of the Teeth: Data Protection in
Africa Roundup 2025, Projections for 2026. Available at [Link]/blog/data-
protection-in-africa-roundup. Annual roundup covering legislative activity, enforcement
actions, and DPA developments across the continent.
Future of Privacy Forum, The African Union's Data Policy Framework: Context, Key
Takeaways, and Implications for Data Protection on the Continent, 2023. Available at
[Link]/blog. Analytically sharp reading of the Framework, useful for understanding its
relationship to Malabo and AfCFTA.
Future of Privacy Forum, Towards a Continental Approach to Data Protection in Africa:
Analysis of Regional Economic Communities, 2024. Available at [Link]/wp-
content/uploads/2024/02/[Link]. Comparative analysis of data
protection across the RECs; useful for understanding how EAC, ECOWAS, SADC and
ECCAS frameworks differ.
Joshua Kitili, Commercial Use of Personal Data (Direct Marketing) in Kenya – Small and
Medium-Sized Enterprises (SME) Manual [2023], CIPIT
<[Link]
kenya-small-and-medium-sized-enterprises-sme-manual/>.
Network of African Data Protection Authorities (NADPA-RAPDP), [Link]. The peer
network of African DPAs; useful for tracking institutional cooperation and enforcement
coordination across the continent.
Okorie, Chijioke, and Omino, Melissa, Addressing Inequitable Openness in Licences for
Sharing African Data and Datasets Through the Nwulite Obodo Open Data Licence, Law,
Technology and Humans, 2025. Available at [Link]. Adjacent reading on how
African datasets are licensed and governed; relevant for learners thinking about the
intersection of data protection, AI governance and indigenous knowledge, and for the
questions AfCFTA and the AU AI Strategy leave open.
Office of the Data Protection Commissioner, Republic of Kenya, [Link]. Kenya's
regulator; the authoritative source for Kenyan enforcement decisions, guidance notes,
and participation in regional and continental processes.