The State of African Data Protection Enforcement, H1 2026

1. Executive summary

African data protection enforcement is now measurable, and the measurements contradict the way the field usually gets described. Five findings from the first systematic dataset of the continent's enforcement activity:

1. The gap is not laws; it is visibility. 44 of 54 African Union member states have a data protection law in force, and 32 have an operational regulator. But only 23 of those regulators are actually enforcing, and just 17 publish their decisions anywhere. 6 countries (Burkina Faso, Cape Verde, Ghana, Malawi, Zambia, Zimbabwe) sanction controllers without publishing a single decision. Compliance teams in those markets are flying blind, not because enforcement is absent but because it is invisible.

2. Enforcement volume is at a record high. The two busiest quarters in the dataset are the two most recent complete ones: Q4 2025 and Q1 2026. H1 2026 produced 50 published enforcement actions (Kenya 42, South Africa 3, Angola 2, Uganda 2, Nigeria 1), against 60 in H1 2025, and the 2026 figure is a floor: regulators, Kenya's ODPC especially, publish decisions in batches months after they are made, so the H1 2026 count will rise as later batches land.

3. The headline number is over a thousand times the typical one. The median administrative penalty across the 23 disclosed penalties in the dataset is USD 150,000. The median ODPC compensation award in Kenya is KES 650,000 (about USD 5,050). The number that travels, the USD 220 million FCCPC fine against Meta and WhatsApp in Nigeria, is roughly fifteen hundred times the median penalty and forty thousand times the median Kenyan award: a consumer-protection tribunal outcome and an extreme outlier that describes nothing but itself. Means are quoted in the footnotes of this report, never in its headlines.

4. Enforcement grew teeth that are not fines. In February 2026 the High Court of Kenya adopted an ODPC compensation determination as an order of the court, giving data subjects execution machinery against non-paying respondents. Uganda recorded the continent's first criminal conviction of a company director under a data protection statute in July 2025. Kenya's ODPC recommended criminal prosecution in 28 matters in the dataset, and Mauritius's Data Protection Office has referred 8 cases to the police for prosecution under section 20 of its Act since 2012. The cost of non-compliance is no longer denominated only in money.

5. Big Tech is squarely inside African jurisdiction. Meta was fined twice in Nigeria and is under a smart-glasses investigation in Kenya. Nigeria's NDPC opened investigations into Temu, TikTok and Truecaller. Uganda's PDPO ordered Google to register locally and affirmed the extraterritorial reach of its Act. The question for global platforms has moved from whether African data protection law applies to them to how many regulators will apply it at once.

2. The landscape: 44 laws, 17 publishing regulators

First publication of the Research Hub's 54-country landscape dataset, verified country by country with per-cell source URLs.

Every AU member state now sits somewhere on a five-step funnel, and every step loses countries:

• 44 of 54 states have a comprehensive data protection law in force. 1 more (The Gambia) has enacted one not yet commenced, 4 have bills before parliament or cabinet (Liberia, Sierra Leone, Mozambique, Namibia), and 5 have no instrument at all (Libya, Sudan, Guinea-Bissau, Eritrea, South Sudan).
• 32 states have an operational regulator.
• 23 of those regulators are enforcing in any observable way: sanctions, compelled registrations, public warnings.
• 17 publish decisions in any venue at all.

The two gaps in that funnel define the market for a verified public enforcement record. The first, between operational and enforcing (32 against 23), is the watchlist: authorities in Togo, Somalia, Mauritania, Eswatini, Seychelles and Gabon exist, staff up and issue guidance but have produced no public enforcement record yet. The second, between enforcing and publishing (23 against 17), is where compliance work is hardest: Burkina Faso, Cape Verde, Ghana, Malawi, Zambia, Zimbabwe all sanction or compel without publishing. A controller in Lusaka or Accra cannot read the enforcement record of its own regulator, because there is none to read.

Language is the other structural fact. Of the 17 publishing regulators, 9 publish in a language other than English (French in Algeria, Morocco, Tunisia, Benin, Burkina Faso, Côte d'Ivoire, Mali, Niger and Senegal; Portuguese in Angola). No service systematically translates them. West Africa is the publication heartland, with six publishing regulators, and Benin's APDP alone reported examining 907 files in 2025, up from 560 in 2024 [W-CHECK: figures from APDP annual reporting, sourced in the landscape record; verify against the APDP report before publication]. English coverage of African data protection is a minority report of the continent's actual enforcement output.

The regional pattern is sharper than the continental one:

West Africa is the publication heartland: six publishing regulators, five of them francophone. East Africa pairs the continent's anchor enforcement jurisdiction (Kenya) with its newest statutes (Burundi's Law 1/03, March 2026). Central Africa is the striking cell in that table: eight states, eight laws in force, not one published decision. Cameroon, the Central African Republic, the DRC and Congo all legislated recently and none has a producing authority. The region is a legislative boom running years ahead of its institutions.

The legislative wave is real but younger than the enforcement story. Twelve countries adopted or moved major instruments since 2024, including Cameroon, Botswana, Malawi, Ethiopia, Djibouti, The Gambia and Burundi. None of them has produced a published enforcement action yet. Institutions lag statutes by years; the middle of the funnel is where the next five years of enforcement growth already sits, and where a compliance budget set today should already be pointing.

3. Enforcement by the numbers: 595 verified records

The Research Hub tracker holds 595 verified enforcement records across 10 jurisdictions: Kenya (303), South Africa (17), Nigeria (10) and Uganda (5). Every record cites its source document. The Kenya share (51%) reflects two things at once: the ODPC's genuinely exceptional output, and the fact that it publishes individual reasoned determinations where most regulators publish nothing. Read jurisdiction comparisons as comparisons of the public record, not of total activity (methodology).

Annual volumes tell a growth story: 85 published actions in 2023, 188 in 2024, 146 in 2025, and 50 already in H1 2026 despite the lag. Q4 2025 and Q1 2026 are the two heaviest quarters in the dataset.

The money, median first

Two different monetary regimes operate on the continent, and averaging across them misleads.

Administrative penalties (23 disclosed, in Nigeria, South Africa and Uganda): median USD 150,000. The largest is the FCCPC's USD 220,000,000 order against Meta Platforms and WhatsApp, imposed under Nigeria's consumer-protection statute for data practices and upheld by the Competition and Consumer Protection Tribunal in 2025 [W-CHECK: this is a consumer-protection action counted as data enforcement; the methodology states the inclusion reasoning, confirm you are comfortable with it]. The mean across all 23 penalties is USD 11,958,960; excluding Meta's two Nigerian fines it falls to USD 1,059,814, which is why this report leads with medians.

Compensation orders (38, all Kenyan): the ODPC's remedy of choice is compensation to the data subject, not a fine. Median award KES 650,000 (USD 5,050 at the documented year-average rate); the largest to date is KES 10,000,000 against Oxygene Marketing for the unauthorised commercial use of a prominent athlete's image. Total ordered across all 38 awards: KES 69,238,907 (about USD 525,280). These are life-sized numbers, and that is the point: the ODPC regime prices dignity harms for individual complainants, while the Nigerian and South African regimes price organisational non-compliance.

What gets enforced

Of the 595 records, 250 upheld the complaint in whole or part and 49 dismissed it: an 84% uphold rate among adjudicated complaints. Enforcement notices issued: 183. Prosecution recommendations: 28.

The 84% uphold rate deserves a moment. It does not mean African regulators rubber-stamp complaints; it means the complaints that reach a published determination are the ones with substance, after triage and mediation filter the rest. For respondents the practical reading is that a complaint which survives to adjudication will probably succeed, which prices early settlement accordingly.

Public against private. Respondents are overwhelmingly private (413 of 595, 69%); 27 are public bodies and 155 are named individuals, mostly directors and proprietors reached personally. South Africa inverts the pattern: its Information Regulator's hardest actions to date target government departments, not companies, and its two largest fines sit on the Department of Justice and the Department of Basic Education. Kenya sanctions the state rarely; Nigeria has yet to publish an action against a public body at all. Whether that reflects complaint patterns or enforcement appetite is not answerable from the public record, and this report does not guess.

A record can cite several categories. Kenya-weighted, like the dataset.

The most-litigated sections

Rolling subsection citations into their parent sections, the Kenyan provisions regulators actually use are a short list:

Section 25 (lawful-processing principles) and s.26 (data subject rights) do the substantive work; s.56 (complaints) and s.65 (compensation) are the procedural spine. For practitioners the message is blunt: master five sections and you have covered the provisions cited in most Kenyan determinations.

Sectors

154 further records are classified "general": the source document states no dominant sector.

Digital lending (43) and banking (60) lead, and they lead for the same reason: both run on granular personal and contact data, and both generate complainants when that data is misused for collection or marketing. The 25 unlawful-debt-collection records are almost a genre: lender contacts a borrower's phone book, regulator orders compensation.

For the compliance desk, three numbers in this chapter do most of the work. The 84% uphold rate prices the risk of letting a complaint reach adjudication. The gap between the median penalty (USD 150,000) and the mean is the reason internal risk models should never be calibrated on headline fines. And the violation table is a control checklist in disguise: consent records, erasure-request handling and image rights govern more African enforcement outcomes than breach response does, whatever the conference agenda says.

4. Jurisdiction deep-dives

Kenya: the deepest public enforcement record in Africa

Kenya contributes 303 records, and the depth is the differentiator: no other African regulator publishes individual reasoned determinations at this volume. The ODPC published 46 tracked actions in 2023, 117 in 2024, 98 in 2025 and 42 already in H1 2026. Its uphold rate among adjudicated complaints is 84%.

Three structural facts stand out.

The remedy is compensation, and it now converts to court orders. The ODPC prices individual harms (median KES 650,000), and until this year the open question was collection. The High Court answered it on 16 February 2026, adopting a KES 250,000 ODPC award against Africa International University as an order of the court under ss.64 and 65 of the Act. A determination is no longer a strongly worded letter; it is an executable debt. Our analysis of the enforcement pathway: ODPC determinations now have teeth.

The five largest awards to date show what the ceiling looks like in practice:

The pattern in that table repeats through the full dataset: marketing use of a person's image without consent is the most expensive thing a Kenyan organisation can do with personal data. Public figures collect the headline awards; the same violation costs small businesses real money at smaller scale.

Criminal exposure is real. The ODPC recommended prosecution in 28 tracked matters (with 8 further police referrals in Mauritius), 23 records cite obstruction of the Data Commissioner, and 12 enforce the registration obligation itself. Directors, not just companies, appear in those recommendations.

The caseload is consumer-shaped. Unauthorised use of images (90 records, including Casa Vera Lounge's KES 5,000,000 determination for posting a patron's photo), digital-lending phone-book harvesting, and erasure requests ignored (145 records citing it) dominate. The digital-lending genre alone accounts for 43 records and follows a script: an app harvests the borrower's contact list at install, the collections team messages employers and relatives when repayment slips, the borrower complains, the ODPC orders compensation and an enforcement notice. Awards at the median scale read, from the outside, like a tolerable cost of the collection model; the High Court execution pathway and the prosecution recommendations are what change that arithmetic. This is a complaints-driven regulator whose docket mirrors what ordinary Kenyans experience as privacy harm. The Worldcoin litigation and the ODPC's April 2026 suo moto investigation into Meta's Ray-Ban smart glasses [W-CHECK: investigation record is media-sourced; confirm the ODPC has not published its own notice] show the same office now reaching for frontier-technology questions. Context: our Worldcoin ruling analysis and wearables and biometrics briefing.

Nigeria: fewer actions, bigger numbers, wider net

Nigeria's 10 records are the inverse of Kenya's: low volume, high stakes. The NDPC's disclosed penalties run from NITDA's NGN 10,000,000 SokoLoan fine in 2021, the continent's first tracked action, through Fidelity Bank's NGN 555,800,000 penalty (under appeal) to MultiChoice's NGN 766,242,500 fine for intrusive processing and unlawful cross-border transfer. Meta has paid or faces two further orders: the FCCPC's USD 220,000,000 and the NDPC's USD 32,800,000 resolution over behavioural advertising.

The structural story is administrative. The General Application and Implementation Directive (GAID) 2025 now does the day-to-day governing under the NDP Act, and the NDPC has moved to sweep-scale supervision: an ongoing compliance action against 1,369 organisations at once, alongside platform investigations into Temu (an estimated 12.7 million Nigerian users), TikTok and Truecaller. Nigeria publishes press releases rather than reasoned decisions, so several records rest on credible media and firm reporting rather than primary documents; each record's source is linked. Our jurisdiction map: NDPC enforcement, mapped.

South Africa: the regulator that sues the state

South Africa's 17 records skew public-sector in a way no other tracked jurisdiction does. The Information Regulator's landmark actions are against government: the Department of Justice's R5,000,000 fine for the 2021 ransomware breach, the Department of Basic Education's R5,000,000 penalty over the matric-results publication (under appeal), and PAIA enforcement against the State Security Agency. The IR is also the continent's most litigation-tested regulator; the appeals now pending will define POPIA's penalty jurisprudence. Our docket review: the Information Regulator's litigation docket.

Three further records are FSCA administrative penalties, including the R358,750,000 order against former Steinhoff director Stephanus Grobler [W-CHECK: FSCA records are financial-sector conduct actions with data-and-disclosure dimensions, included under the tracker's documented criteria; confirm the inclusion policy holds for the report]. They are reported separately from POPIA statistics throughout.

Uganda: two records, two precedents

Uganda contributes 5 records and both are firsts. The Nano Loans/Quickloan matter produced the continent's first criminal conviction of a director under a data protection statute (UGX 300,000 fine plus a criminal record, for unregistered processing and debt-shaming) [W-CHECK: "first on the continent" rests on secondary reporting; no earlier conviction surfaced in our collection, verify before publication]. And the PDPO's Google determination ordered a company with no Ugandan office to register, appoint a DPO and evidence its cross-border safeguards, the clearest extraterritoriality holding by any African DPA to date. The PDPO cannot fine; its orders are declaratory and its complainants go to court for money. That makes Uganda's docket small and its precedents large. Analysis: the extraterritoriality precedent African regulators were waiting for.

The watch list

Six entries to watch, from the landscape tiers:

• Tanzania (tier 1): the PDPC published its first-ever complaint ruling in August 2025. Low volume, English-language, operational since 2023, and the tracker's next likely addition.
• Mauritius (tier 1): the continent's most GDPR-aligned framework and a mature office publishing complaint decisions, guidance and annual reports since 2009.
• Ghana: enforcing without publishing. The DPC runs registration drives and compliance audits, yet no systematically published decisions exist; 2026 is shaping into its enforcement year. Briefing: Ghana's enforcement era begins.
• Zambia: enforcement began in March 2025 behind a registration deadline carrying criminal penalties for default. Nothing published yet.
• Zimbabwe: POTRAZ operates one of the continent's most aggressive licensing regimes under SI 155/2024, with mandatory controller licences, 24-hour breach notification and criminal exposure of up to seven years for unlicensed processing. Also unpublished. Both countries belong on any pan-African compliance matrix despite their invisibility.
• The francophone ten (Algeria, Benin, Burkina Faso, Mali, Morocco, Niger, Tunisia): 7 publishing regulators nobody translates. Benin and Morocco lead on volume, and Morocco's CNDP is shifting from pedagogy to enforcement. Whoever translates this corpus first owns the reference layer for francophone African data protection; the Research Hub's collection playbook covers all ten venues.

5. H1 2026: the developments that matter

Four developments from the half-year change practice, not just statistics.

1. ODPC awards became executable debts (Kenya, February). The High Court's adoption of a determination as a court order, Muthoni v Africa International University, closes the gap between winning before the ODPC and getting paid. Every compensation figure in chapter 3 now carries execution risk for respondents who ignore it. Full analysis.

2. Nigeria industrialised supervision (February). The Temu investigation extended the NDPC's platform docket to four global companies, while the 1,369-organisation compliance action moved Nigerian enforcement from case-by-case to sweep-scale. Under GAID 2025, compliance filings, not complaints, are becoming the trigger.

3. Kenya's regulator reached for frontier hardware (April). The ODPC's suo moto investigation into Meta's Ray-Ban smart glasses is the first African regulatory action addressing always-on wearable cameras, opened on the regulator's own motion rather than a complaint. Together with the Worldcoin aftermath, it marks the ODPC's shift from consumer complaints toward technology-first supervision. Briefing: wearables, biometrics and the ODPC.

4. South Africa's penalty jurisprudence went to the courts. With the Department of Basic Education and State Security Agency matters both under appeal, POPIA's enforcement framework is being stress-tested in litigation. The outcomes will determine whether the IR's R5 million ceiling-testing notices survive contact with the bench. Docket review.

The 2025 antecedents that frame all four, Uganda's Google extraterritoriality determination and criminal conviction among them, are covered in the analysis library; this report counts them in the statistics and does not re-argue them.

6. What H2 2026 will bring

Prospective, dated, and checkable. What compliance teams should have in the diary:

• 4 November 2026, Kenya: the VASP licensing deadline. Virtual-asset service providers must be licensed under the Virtual Asset Service Providers Act 2025; as of our July analysis the implementing regulations were still not gazetted, compressing the compliance window. The first African enforcement wave against crypto firms qua data controllers is plausible in 2027. Countdown analysis: 121 days to 4 November.
• 1 November 2026, Egypt: the PDPL transitional period ends. The law sat dormant for five years until the Executive Regulations entered force on 2 November 2025 with a one-year compliance window; after 1 November 2026, financial and criminal penalties apply (landscape record). Africa's second-most-populous market acquires a live data protection regime, on paper, overnight. Whether the new Personal Data Protection Center enforces is the continent's biggest open enforcement question for 2027.
• Appeals to watch: Fidelity Bank v NDPC (NGN 555,800,000), Department of Basic Education and State Security Agency in South Africa. The dataset carries 3 appealed and 8 ongoing matters; each resolution rewrites a penalty benchmark.
• Investigations due to conclude: Temu, TikTok and Truecaller in Nigeria; Meta's smart glasses in Kenya; the Information Regulator's Department of Health matter. The NDPC's 1,369-organisation action should produce Nigeria's first mass-remediation statistics.
• Kenya's H1 numbers will be revised upward. The ODPC publishes in batches (44 tracked actions in Q1 2026 against 6 so far in Q2 is lag, not decline). The tracker updates as batches land; treat this report's H1 count as the floor.
• Ghana's publication decision. If the DPC pairs its 2026 enforcement push with published decisions, it becomes anglophone Africa's next citable jurisdiction; if not, it stays on the invisible list with Zambia and Zimbabwe.

7. Methodology and about the data

The dataset. 595 enforcement records, 2011–2026, all verified: human-reviewed against the cited source before publication. Records span 514 determinations, 49 enforcement notices, 20 penalty notices, 7 investigations, 3 court rulings and 2 settlements. Complainant names are never published, even where the regulator publishes them; source links preserve the full record.

Inclusion criteria. Public actions by data protection authorities and courts applying data protection law, plus adjacent actions where the sanctioned conduct is data practice (the FCCPC's Meta order; three FSCA penalty notices with data-and-disclosure dimensions, reported separately throughout). Media reporting is accepted as a source where the regulator publishes no primary document (parts of the Nigerian record); every record links its source, and records failing verification are excluded entirely rather than published with caveats.

Coverage honesty. The dataset is deepest in Kenya by an order of magnitude (303 of 595 records). That is partly the ODPC's real output and partly its publication practice, and it means continental aggregates are Kenya-weighted: this report flags the weighting wherever it matters rather than letting the reader discover it. Volumes are counts of the public record, a floor on actual enforcement, never an estimate of it. 170 records carry month (not day) precision dates, as published by the regulator.

Money. Original currency is authoritative. USD conversions use documented decision-year average rates (KES 129/USD for 2026; the full table ships with the dataset's migration script) and are rounded. Medians lead; means appear only with the median alongside, because two Meta-scale orders distort every average they touch.

The analysis. Every statistic in this report is computed by analyze.py, published alongside the report with its validator; the charts regenerate from the same script. The master dataset itself is not distributed raw (licensing); every record it holds is inspectable on its own tracker page. If a number here looks wrong, report it to research@lawlab.africa and the correction policy applies.

Citing this report. Wanjiku Karanja, The State of African Data Protection Enforcement, H1 2026 (Law Lab Africa Research, July 2026), research.lawlab.africa/reports. Free to cite and quote with attribution; commercial reuse of the underlying dataset is licensed separately (licensing). The tracker itself, with every record cited here, is at research.lawlab.africa/tracker.

Law Lab Africa is a technology-law consultancy and research house. The Research Hub turns African regulatory activity into a verified public record: the tracker, the landscape survey, the laws library and this report series. For enforcement alerts as new decisions are tracked, subscribe at research.lawlab.africa/reports.