| 1 | Angola | Southern Africa | Data Protection Law No. 22/11 of 17 June 2011
In force | Law No. 11/02 on Access to Administrative Documents 2002
In force | Agência de Protecção de Dados (APD) | Live |
| 2 | Côte d'Ivoire | West Africa | Law No. 2013-450 on the Protection of Personal Data
In force | Law No. 2013-867 on Access to Information of Public Interest
In force | Autorité de Protection des Données à Caractère Personnel (spun out of ARTCI) | Live |
| 3 | Eswatini | Southern Africa | Data Protection Act No. 5 of 2022
In force | None | Eswatini Data Protection Authority (under the Eswatini Communications Commission) | Live |
| 4 | Gabon | Central Africa | Law No. 001/2011 on the Protection of Personal Data, as amended by Law No. 025/2023
In force | None | Autorité de Protection des Données Personnelles et de la Vie Privée (APDPVP, ex-CNPDCP) | Live |
| 5 | Kenya | East Africa | Data Protection Act 2019 (No. 24 of 2019; General/Registration/Complaints Regulations 2021)
In force | Access to Information Act 2016
In force | Office of the Data Protection Commissioner (ODPC) | Live |
| 6 | Mauritius | East Africa | Data Protection Act 2017 (amended 2023)
In force | None | Data Protection Office (DPO) | Live |
| 7 | Nigeria | West Africa | Nigeria Data Protection Act 2023 (NDPA; NDPR 2019 remains subsidiary)
In force | Freedom of Information Act 2011
In force | Nigeria Data Protection Commission (NDPC) | Live |
| 8 | Senegal | West Africa | Law No. 2008-12 on the Protection of Personal Data (modernization bill pending)
In force | Law No. 2025-15 on Access to Information
In force | Commission de Protection des Données Personnelles (CDP) | Live |
| 9 | South Africa | Southern Africa | Protection of Personal Information Act 2013 (POPIA; fully effective 1 July 2021)
In force | Promotion of Access to Information Act 2000 (PAIA)
In force | Information Regulator | Live |
| 10 | Uganda | East Africa | Data Protection and Privacy Act 2019 (Regulations 2021)
In force | Access to Information Act 2005
In force | Personal Data Protection Office (PDPO) | Live |
| 11 | Tanzania | East Africa | Personal Data Protection Act 2022 (Complaints/Collection Regulations 2023)
In force | Access to Information Act 2016
In force | Personal Data Protection Commission (PDPC) | Tier 1 |
| 12 | Algeria | North Africa | Law No. 18-07 on the Protection of Individuals in the Processing of Personal Data (amended by Law No. 25-11 of July 2025) 2018
In force | None | Autorité Nationale de Protection des Données à Caractère Personnel (ANPDP) | Tier 2 |
| 13 | Benin | West Africa | Digital Code (Law No. 2017-20, Book 5: Protection of Personal Data) 2018
In force | Information and Communication Code (Law No. 2015-07)
In force | Autorité de Protection des Données à Caractère Personnel (APDP) | Tier 2 |
| 14 | Burkina Faso | West Africa | Law No. 001-2021/AN on the Protection of Persons with regard to Personal Data Processing (replaced Law 010-2004)
In force | Law No. 051-2015/CNT on the Right of Access to Public Information and Administrative Documents
In force | Commission de l'Informatique et des Libertés (CIL) | Tier 2 |
| 15 | Mali | West Africa | Law No. 2013-015 on the Protection of Personal Data (amended by Law No. 2017-070)
In force | None | Autorité de Protection des Données à Caractère Personnel (APDP) | Tier 2 |
| 16 | Morocco | North Africa | Law No. 09-08 on the Protection of Individuals with regard to Processing of Personal Data 2009
In force | Law No. 31-13 on the Right of Access to Information 2018
In force | Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP) | Tier 2 |
| 17 | Niger | West Africa | Law No. 2022-59 on the Protection of Personal Data (as modified by Law 2023-31 and Ordinances 2024-16, 2024-29)
In force | Charter on Access to Public Information and Administrative Documents (Ordinance 2011-22)
In force | Haute Autorité de Protection des Données à Caractère Personnel (HAPDP) | Tier 2 |
| 18 | Tunisia | North Africa | Organic Law No. 2004-63 on the Protection of Personal Data (replacement bill tabled 2025)
In force | Organic Law No. 2016-22 on the Right of Access to Information
In force | Instance Nationale de Protection des Données Personnelles (INPDP) | Tier 2 |
| 19 | Botswana | Southern Africa | Data Protection Act 2024 (Act 18 of 2024; in force 14 January 2025, replacing the 2018 Act)
In force | None | Information and Data Protection Commission | Tier 3 |
| 20 | Burundi | East Africa | Law No. 1/03 of 10 March 2026 on the Protection of Personal Data
In force | None | Independent supervisory authority provided for by Law 1/03; not yet established | Tier 3 |
| 21 | Cameroon | Central Africa | Law No. 2024/017 of 23 December 2024 relating to Personal Data Protection
In force | None | Personal Data Protection Authority (provided for by Law 2024/017; composition awaited) | Tier 3 |
| 22 | Cape Verde | West Africa | Data Protection Law (Lei No. 133/V/2001, as amended by Lei No. 121/IX/2021)
In force | None | Comissão Nacional de Proteção de Dados (CNPD) | Tier 3 |
| 23 | Central African Republic | Central Africa | Law No. 24.001 of January 2024 on the Protection of Personal Data
In force | None | DPA provided for by Law 24.001; not established (Jan 2025 deadline missed) | Tier 3 |
| 24 | Chad | Central Africa | Law No. 007/PR/2015 on the Protection of Personal Data
In force | None | Agence Nationale de Sécurité Informatique et de Certification Électronique (ANSICE) | Tier 3 |
| 25 | Comoros | East Africa | Law No. 14-029/AU on the Protection of Personal Data (adopted 26 June 2014; reported 2021 promulgation unverified)
In force | None | National Authority for the Protection of Personal Data (provided for; not operational) | Tier 3 |
| 26 | Democratic Republic of the Congo | Central Africa | Digital Code (Ordinance-Law No. 23/010 of 13 March 2023, Book on personal data)
In force | None | Autorité de Protection des Données (APD; created by Digital Code arts. 262-270, not yet constituted: ARPTC exercises interim missions) | Tier 3 |
| 27 | Djibouti | East Africa | Digital Code (approved by National Assembly 30 June 2025; personal-data regime of 156 articles)
In force | None | Commission Nationale de la Protection des Données Personnelles (CNDP, created by the Digital Code; being constituted) | Tier 3 |
| 28 | Egypt | North Africa | Personal Data Protection Law No. 151 of 2020 (Executive Regulations: PM Decree No. 816 of 1 November 2025)
In force | None | Personal Data Protection Center (PDPC, under MCIT) | Tier 3 |
| 29 | Equatorial Guinea | Central Africa | Law No. 1/2016 on the Protection of Personal Data
In force | None | Órgano Rector for the Protection of Personal Data (provided for; not operational) | Tier 3 |
| 30 | Eritrea | East Africa | No DP law | None | None | Tier 3 |
| 31 | Ethiopia | East Africa | Personal Data Protection Proclamation No. 1321/2024
In force | Freedom of the Mass Media and Access to Information Proclamation No. 590/2008
In force | Ethiopian Communications Authority (ECA, designated supervisory authority) | Tier 3 |
| 32 | Gambia | West Africa | Personal Data Protection and Privacy Act 2025
Enacted, not commenced | Access to Information Act 2021
In force | National Data Protection Commission (provided for; not yet established) | Tier 3 |
| 33 | Ghana | West Africa | Data Protection Act 2012 (Act 843; replacement Data Protection Bill 2025 pending)
In force | Right to Information Act 2019 (Act 989)
In force | Data Protection Commission (DPC) | Tier 3 |
| 34 | Guinea | West Africa | Law L/2016/037/AN on Cybersecurity and Personal Data Protection
In force | Organic Law L/2010/004/CNT on the Right of Access to Public Information
In force | DPA provided for by the 2016 law but never established; ARPT exercises adjacent oversight | Tier 3 |
| 35 | Guinea-Bissau | West Africa | No DP law | None | None | Tier 3 |
| 36 | Lesotho | Southern Africa | Data Protection Act 2011 (Act No. 5 of 2012)
In force | None | Data Protection Commission (provided for; never appointed) | Tier 3 |
| 37 | Liberia | West Africa | Act for the Collection, Processing, Transmission, Storage, Protection and Use of Personal Information (bill before House committee since June 2025)
Bill | Freedom of Information Act 2010
In force | None | Tier 3 |
| 38 | Libya | North Africa | No DP law | None | None | Tier 3 |
| 39 | Madagascar | East Africa | Law No. 2014-038 on the Protection of Personal Data (implementing decree 2023-1541)
In force | None | Commission Malagasy de l'Informatique et des Libertés (CMIL; being operationalized) | Tier 3 |
| 40 | Malawi | East Africa | Data Protection Act 2024
In force | Access to Information Act 2017
In force | Malawi Data Protection Authority (statutory body under MACRA) | Tier 3 |
| 41 | Mauritania | West Africa | Law No. 2017-020 on the Protection of Personal Data
In force | None | Autorité de Protection des Données à Caractère Personnel (APD) | Tier 3 |
| 42 | Mozambique | East Africa | Proposta de Lei de Protecção de Dados Pessoais (Council of Ministers approved 4 March 2026; awaiting Assembly vote)
Bill | Right to Information Law No. 34/2014
In force | ANPD provided for by the bill; INTIC, Bank of Mozambique and courts cover the interim | Tier 3 |
| 43 | Namibia | Southern Africa | Data Protection Bill (tabled in Parliament Sept-Oct 2025; not yet enacted at last verification)
Bill | Access to Information Act No. 8 of 2022
In force | None | Tier 3 |
| 44 | Republic of the Congo | Central Africa | Law No. 29-2019 on the Protection of Personal Data
In force | None | Commission Nationale pour la Protection des Données à Caractère Personnel (created by Law No. 5-2025 of 29 March 2025; being constituted) | Tier 3 |
| 45 | Rwanda | East Africa | Law No. 058/2021 on the Protection of Personal Data and Privacy
In force | Law No. 04/2013 on Access to Information
In force | National Cyber Security Authority (NCSA) | Tier 3 |
| 46 | Seychelles | East Africa | Data Protection Act 2023 (Act 24 of 2023; in force 22 Dec 2023, transition ended 22 June 2025)
In force | Access to Information Act 2018
In force | Information Commission | Tier 3 |
| 47 | Sierra Leone | West Africa | Data Protection and Right to Access Information Bill (national validation concluded Nov 2025; National Data Protection Policy approved April 2026)
Bill | Right to Access Information Act 2013
In force | Right to Access Information Commission (ATI only; combined DP/ATI commission proposed in bill) | Tier 3 |
| 48 | Somalia | East Africa | Data Protection Act (Law No. 005 of 2023; effective 23 March 2023)
In force | None | Somalia Data Protection Authority | Tier 3 |
| 49 | South Sudan | East Africa | No DP law | Right of Access to Information Act 2013
In force | None | Tier 3 |
| 50 | Sudan | North Africa | No DP law | Access to Information Act 2015
In force | None | Tier 3 |
| 51 | São Tomé and Príncipe | Central Africa | Law No. 3/2016 on the Protection of Personal Data
In force | None | Agência Nacional de Protecção de Dados Pessoais (ANPDP) | Tier 3 |
| 52 | Togo | West Africa | Law No. 2019-014 on the Protection of Personal Data
In force | Law No. 2016-006 on Freedom of Access to Information and Public Documentation
In force | Instance de Protection des Données à Caractère Personnel (IPDCP) | Tier 3 |
| 53 | Zambia | Southern Africa | Data Protection Act No. 3 of 2021
In force | Access to Information Act No. 24 of 2023
In force | Office of the Data Protection Commissioner / Data Protection Commission | Tier 3 |
| 54 | Zimbabwe | Southern Africa | Cyber and Data Protection Act [Chapter 12:07] of 2021 (SI 155/2024 licensing regulations)
In force | Freedom of Information Act 2020
In force | Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ, designated Data Protection Authority) | Tier 3 |