Enforcement in the Dark: Who Publishes, Who Hides

1. The gap, measured

African data protection has a visibility problem, not a legislation problem. The funnel from statute to public record loses countries at every step:

• 44 of 54 African Union states have a comprehensive data protection law in force.
• 32 have an operational regulator.
• 23 of those regulators enforce in an observable way: sanctions, compelled registrations, formal notices, public warnings.
• 17 publish their decisions anywhere at all.

The last step is the story. 6 countries (Burkina Faso, Cape Verde, Ghana, Malawi, Zambia, Zimbabwe) sanction and compel without publishing a single decision. A controller in those markets cannot read the enforcement record of its own regulator, because there is none to read. And the 17 that do publish are not the 17 you would guess: 8 publish in French, one in Portuguese, and the English-language publishers number just 7.

2. The scorecard

Every one of the 54 states sits in exactly one tier:

Tier C includes Sierra Leone, whose operational commission is an access-to-information body; its data protection law is still a bill. Tier assignments carry per-country source URLs in the landscape dataset.

The 23 enforcing states, where the publish-or-hide distinction actually bites, in detail:

The regional pattern is stark:

West Africa is the publication heartland. Central Africa is the empty cell: 8 states, 8 laws in force, 1 published decisions. The region legislated and never built the institutions to match.

3. The six in the dark

Each of the 6 dark-tier countries has real enforcement behind its silence, which is what makes the silence expensive.

Zimbabwe runs one of the continent's most demanding regimes on paper: mandatory controller licences under SI 155 of 2024, 24-hour breach notification, and criminal exposure of up to seven years for unlicensed processing [W-CHECK: characterisation from the landscape record's sources; spot-check the SI before publication]. Not one decision is published.

Zambia opened enforcement in March 2025 behind a registration deadline carrying criminal penalties for default. Nothing published.

Ghana's DPC runs registration drives, compliance audits and has publicly warned that fines are coming; 2026 is shaping into its enforcement year. No systematically published decisions exist. Briefing: Ghana's enforcement era begins.

Malawi operationalised fast: a dedicated authority site, a published Data Protection Handbook, registration for significant controllers and a financial-sector compliance push. Decisions: none published.

Cape Verde's CNPD has been operational for a decade and publishes guidance and notices, but no systematic archive of its deliberations could be confirmed [W-CHECK: recheck the CNPD site; if a deliberations archive exists this country moves to Tier A and the numbers self-correct on re-run].

Burkina Faso's CIL (Commission de l'Informatique et des Libertés) has run since December 2007, among the oldest data protection authorities in francophone Africa, and it stayed active through 2025 under Law No. 001-2021/AN: a government-wide awareness campaign launched by the Prime Minister in July 2025, and humanitarian-sector training with UNHCR that September. It publishes deliberations and annual reports, but at low volume and with no systematic archive of decisions that could be confirmed and collected [W-CHECK: recheck cil.bf for a collectable deliberations archive; if one exists Burkina Faso moves toward Tier A and the numbers self-correct on re-run]. The security situation constrains its reach without having stopped its work.

The practical consequence is identical in all six: compliance advice runs on statutes and guesswork, risk pricing runs on rumour, and the first public evidence most controllers will see of their regulator's philosophy is the sanction that lands on them.

4. The translation gap nobody prices

Of the 17 publishing regulators, 10 (59%) publish in a language other than English: French in Algeria, Benin, Côte d'Ivoire, Mali, Morocco, Niger, Senegal, Tunisia; Portuguese in Angola.

No service systematically translates this corpus, so anglophone coverage of "African data protection enforcement" is in practice coverage of 7 venues: Eswatini, Kenya, Mauritius, Nigeria, South Africa, Tanzania, Uganda. Meanwhile Benin's APDP, one of the continent's most active authorities, reported examining 907 files in 2025, up 61% from 560 in 2024 [W-CHECK: figures from APDP annual reporting as covered by the linked source; verify against the APDP report]. The most complete picture of African enforcement available in English, the Research Hub tracker's 595 records, is itself 303 parts Kenya, because Kenya publishes and most of the continent does not. Whoever translates the francophone corpus first owns the reference layer for half the continent's enforcement record.

5. What the dark costs

Practitioners in Accra, Lusaka and Harare advise against statutes whose enforcement practice is unknowable. The questions clients actually ask (what does this regulator sanction first, how hard, against whom) have answers; the answers are locked in filing cabinets.

Data subjects lose precedent. A complainant in Nairobi can cite hundreds of published determinations to show the ODPC upholds complaints like hers. A complainant in Lusaka can cite nothing, against a regulator that demonstrably enforces.

The regulators themselves lose deterrence, which is publication's cheapest product. An unpublished sanction deters one organisation; a published one deters a sector. Kenya's ODPC and South Africa's Information Regulator are the continent's two most-cited authorities not because they sanction hardest but because they can be read. Publication also disciplines the regulator: reasoned, citable decisions are the difference between enforcement and arbitrariness, and authorities that publish build the legitimacy that survives litigation and leadership change.

Markets cannot price the risk. Professional-indemnity insurers, acquirers running due diligence and investors comparing jurisdictions have enforcement data for 17 countries and folklore for the rest. Invisible enforcement reads as either zero risk or unquantifiable risk, and both readings are wrong.

6. The ask

Publication is the cheapest institutional upgrade in data protection. It requires no statutory amendment in the enforcing countries, no budget line beyond a web page, and no capacity the authorities do not already have (each of the six dark-tier regulators already runs a website that publishes guidance). A PDF archive with dates and respondent names redacted where law requires is the entire threshold.

The Research Hub's standing position, put to every operational authority on the continent, is one sentence: send us your decisions and we will archive, index and cite them, at no cost, with full attribution, the way we already do for 10 jurisdictions. The tracker exists so that the public record outlives news cycles and website redesigns. Regulators that publish get cited, taught and followed; regulators that do not get described by rumour.

This scorecard republishes annually. The tiers are computed, so a country moves the moment its facts do. Cape Verde could join Tier A by uploading an archive it may already hold; Ghana could join it the day its first enforcement decisions go online. The dark tier is a choice, and it is reversible.

Methodology

Tier assignments are computed by analyze.py from the Research Hub landscape dataset: 54 country records, each field carrying a source URL and a verification date, last verified July 2026. Tier definitions: A publishes enforcement decisions in any venue; B shows observable enforcement (sanctions, compelled registrations, formal notices) without publication; C has an operational authority without observable enforcement; D has a law in force without an operational authority; E has no comprehensive law in force. "Publishing" means decisions; guidance and press releases do not qualify. Corrections: research@lawlab.africa, under the correction policy.

Citing this report. Wanjiku Karanja, Enforcement in the Dark: Who Publishes, Who Hides (Law Lab Africa Research, July 2026), research.lawlab.africa/reports. Free to cite and quote with attribution.

Law Lab Africa is a technology-law consultancy and research house. The Research Hub turns African regulatory activity into a verified public record: the tracker, the landscape survey, the laws library and this report series. For alerts as the record grows, subscribe at research.lawlab.africa/reports.