Dados públicos
Leis de proteção de dados e autorizações de investigação em África, por país
Quem autoriza um inquérito, que lei de proteção de dados se aplica e quem o regula, para 54 países africanos.
Como usar isto
Planear trabalho de campo em África implica normalmente duas verificações. Primeiro, saber que organismo deve autorizar o inquérito, muitas vezes o instituto de estatística. Segundo, verificar se o país tem uma lei de proteção de dados, quem a regula e se é necessário registar-se antes de recolher dados pessoais. Encontre o seu país na tabela e abra a respetiva página para os links para o regulador, o organismo de autorização e o instituto de estatística. Quando um campo não tem entrada oficial, a tabela mostra "Não listado".
Resumo para planeamento; confirme os requisitos com o regulador antes do trabalho de campo.
- 23 regulador operacional
- 13 lei aprovada, regulador ainda não confirmado como operacional
- 12 não foi identificada nenhuma lei
- 6 não classificado no controlo de qualidade da fonte
Regulador operacional (23)
Está em vigor uma lei de proteção de dados e um regulador está a funcionar.
| País | Lei de proteção de dados | Regulador | É necessário registo? | Órgão de autorização de inquéritos |
|---|---|---|---|---|
| Argélia | Law 18-07 on the protection of natural persons in the processing of personal data (2018) | ANPDP (Autorite Nationale de Protection des Donnees a caractere Personnel) | prior declaration or authorization for processing | ONS authorization required under the statistics law |
| Benim | Law 2017-20 on the digital code (personal data protection section) (2017) | APDP (Autorite de Protection des Donnees a caractere Personnel) | declaration to APD required before processing | INStaD authorization required under Law 2010-35 on statistics |
| Botsuana | Data Protection Act 2018 (Act 32 of 2018) (2018) | Data Protection Commissioner (Office of the Data Protection Commissioner) | registration of data controllers and processors required | Statistics Botswana permit required under the Statistics Act 2009 |
| Cabo Verde | Law 133/VI/2001 on personal data protection, amended by Law 57/VIII/2021 (2001) | CNPD (Comissao Nacional de Protecao de Dados) | notification to CNPD required for processing | INE authorization required under the statistics law (Lei 50/VI/2005 as amended) |
| Egito | Law 151 of 2020 on the protection of personal data (2020) | Egyptian Data Protection Centre (EDPC) under MCIT | licensing/registration of data processing platforms via EDPC | CAPMAS permit required under Law 175 of 2018 on statistics |
| Gabão | Law 001/2011 on data protection in electronic communications (2011) | CNPD (Commission Nationale de Protection des Donnees) | declaration to CNPD required | DGS authorization required under the statistics law |
| Gâmbia | Data Protection Act 2021 (2021) | Data Protection Commission (established 2023) | registration of data controllers and processors required | GBoS permit required under the Statistics Act 2005 |
| Gana | Data Protection Act 2012 (Act 843) (2012) | Data Protection Commission (Ghana) | registration of data controllers required | GSS permit required under the Statistical Service Act 2019 (Act 1003) |
| Quénia | Data Protection Act 2019 (2019) | Office of the Data Protection Commissioner (ODPC) | registration of data controllers and processors required (exemptions by regulation) | KNBS research license required under the Statistics Act 2006 (research license regime) |
| Maláui | Data Protection Act 2024 (Act 6 of 2024) (2024) | Data Protection Authority (provided for by the Act) | registration regime under the Act; authority being stood up | NSO permit required under the Statistics Act 2013 |
| Mauritânia | Law 2017-020 of 22 July 2017 on personal data protection (2017) | APD (Autorite de Protection des Donnees a caractere Personnel), operational since decree 2022-13 of 18 February 2022 | declaration/authorization regime before the APD | ONS authorization required under Ordinance 2005-026 on statistics |
| Maurícia | Data Protection Act 2017 (2017) | Data Protection Office | registration of data controllers required | Statistics Mauritius authorization required under the Statistics Act 2000 |
| Marrocos | Law 09-08 on the protection of individuals with regard to personal data processing (2009) | CNDP (Commission Nationale de controle de la protection des Donnees a caractere personnel) | prior declaration to CNDP required | HCP authorization required under Law 06-99 on statistics |
| Nigéria | Nigeria Data Protection Act 2023 (2023) | Nigeria Data Protection Commission (NDPC) | registration of data controllers of major importance required | NBS permit required for statistical surveys; NDPC clearance for personal data processing in research |
| Senegal | Law 2008-12 on personal data protection (2008) | CDP (Commission de protection des Donnees personnelles) | prior declaration to CDP required | ANSD authorization required under Law 2004-21 on statistics |
| Seicheles | Data Protection Act 2003, amended by the Data Protection (Amendment) Act 2023 (2003) | Information Commissioner's Office | notification/registration regime under the Act | NBS authorization required under the Statistics Act 2000 |
| Serra Leoa | Data Protection Act 2021 (Act 5 of 2021) (2021) | National Data Protection Commission (NDPC) | registration of data controllers required | SSL permit required under the Statistics Act 2002 |
| África do Sul | Protection of Personal Information Act 4 of 2013 (POPIA) (2013) | Information Regulator (South Africa) | registration of information officers required; deputy information officers for research bodies | Stats SA accreditation required for research access; ethical clearance via research ethics bodies |
| Togo | Law 2019-014 of 29 October 2019 on personal data protection (2019) | IPDCP (Instance de Protection des Donnees a Caractere Personnel) | declaration to IPDCP required; designated data correspondents exempted from prior formalities | DGSCN authorization required under the statistics law |
| Tunísia | Organic Law 2004-63 on personal data processing (2004) | INPDP (Instance Nationale de Protection des Donnees a Caractere Personnel) | prior authorization by INPDP required | INS authorization required under Law 1964-93 on statistics |
| Uganda | Data Protection and Privacy Act 2019 (2019) | Personal Data Protection Office (PDPO) | registration of data controllers and processors required | UBOS clearance required under the Uganda Bureau of Statistics Act 1998; research also requires UNCST registration |
| Zâmbia | Data Protection Act No. 3 of 2021 (2021) | Data Protection Commissioner (under the Ministry of Technology and Science) | registration of data controllers and processors required | ZamStats permit required under the Statistics Act 2018 |
| Zimbabué | Cyber and Data Protection Act 2021 (Act 5 of 2021) (2021) | Data Protection Authority provided for by the Act; operational status limited | registration of data controllers under the Act | ZIMSTAT permit required under the Census and Statistics Act 2017 |
Lei aprovada, regulador ainda não confirmado como operacional (13)
Uma lei é aprovada. Ainda não há registo de um regulador em funcionamento.
| País | Lei de proteção de dados | Regulador | É necessário registo? | Órgão de autorização de inquéritos |
|---|---|---|---|---|
| Angola | Law 22/11 of 17 June 2011 on personal data protection (2011) | Agencia de Protecao de Dados (APD) | prior authorization by the APD for processing | INE authorization required under the statistics framework law |
| Burúndi | Law 1/09 on the protection of personal data (reported) (2009) | not confirmed (no operational authority identified) | not confirmed | ISTEEBU authorization required under Law 1/015 of 2009 on statistics |
| Camarões | Law 2024/017 of 23 December 2024 on personal data protection (2024) | authority provided for by the 2024 law; implementation decrees pending (not confirmed) | declaration/authorization regime under the 2024 law; modalities pending | BUCREP authorization required for censuses and population studies; NSO function shared with INS |
| Chade | Law 020/PR/2015 on cybersecurity and data protection (reported) (2015) | not confirmed (no operational authority identified) | prior declaration regime under the law; implementation unclear | INSEED authorization required under Law 05-17 of 2005 on statistics |
| Congo | Law 29-2019 of 28 October 2019 on personal data protection (2019) | Commission de Controle et de Protection des Donnees a caractere Personnel (provided for by the law) | prior declaration to the authority required | CNSEE authorization required under Law 14-94 on statistics |
| RD Congo | Law 20/017 of 8 July 2020 on personal data protection (2020) | Autorite de Protection des Donnees a caractere Personnel (provided for by the law) | prior declaration/authorization regime under Law 20/017 | INS authorization required under the statistics law (Loi 81-006) |
| Guiné Equatorial | Law 1/2016 on the protection of personal data (2016) | Organo Rector de Proteccion de Datos Personales (provided for by the law) | registry of data files (Registro General de Proteccion de Datos Personales) under the law | INE authorization required; regime not confirmed in practice |
| Essuatíni | Data Protection Act, 2022 (reported) (2022) | Data Protection Commissioner (provided for by the Act) | registration regime under the Act; implementation not confirmed | CSO permit required under the Statistics Act 1967 (as amended) |
| Etiópia | Personal Data Protection Proclamation No. 1321/2024 (2024) | provided for under the proclamation (Ethiopian Communications Authority roles); details pending | registration/notification regime under the proclamation; implementing rules pending | ESS authorization required under the Ethiopian Statistics Service Proclamation 1262/2021 |
| Guiné | Law 2016-037/AN on cybersecurity and personal data protection (2016) | authority provided for by regulatory decree; establishment not confirmed effective | prior declaration or authorization required by law; implementing decree pending | INS authorization required under the statistics law |
| Níger | Law 2017-64 on the protection of personal data (2017) | CNDP (Commission Nationale de Protection des Donnees a caractere Personnel) | declaration/authorization regime under the law | INS authorization required under Law 2015-25 on statistics |
| São Tomé e Príncipe | not confirmed (no comprehensive law identified) | Not listed | Not listed | INE authorization required under the statistics framework law |
| Tanzânia | Personal Data Protection Act 2022 (Act 11 of 2022) (2022) | data protection authority provided for by the Act; operational status not confirmed | registration regime under the Act | NBS permit required under the Statistics Act 2015 |
Não foi identificada nenhuma lei (12)
Não há registo de uma lei nacional de proteção de dados.
| País | Lei de proteção de dados | Regulador | É necessário registo? | Órgão de autorização de inquéritos |
|---|---|---|---|---|
| República Centro-Africana | not confirmed (no comprehensive law identified) | Not listed | Not listed | no formal permit regime confirmed; field research requires government authorization in practice |
| Comores | not confirmed (no comprehensive law identified) | Not listed | Not listed | INSEED authorization required under the statistics law |
| Jibuti | not confirmed (no comprehensive law identified) | Not listed | Not listed | authorization from the statistics department required; regime not confirmed |
| Eritreia | none identified | Not listed | Not listed | no formal research permit regime; independent field research is effectively not permitted |
| Guiné-Bissau | none identified | Not listed | Not listed | INE authorization required under the statistics framework law (Lei 9/2012, confirmed via AFRISTAT mirror) |
| Libéria | none enacted (draft data protection bill pending) | Not listed | Not listed | LISGIS permit required under the Statistics and Geo-Information Act 2019 |
| Líbia | none identified (cybercrime law 2022 contains partial provisions) | Not listed | Not listed | no functioning permit regime confirmed |
| Moçambique | no comprehensive law identified (partial provisions in the 2017 Law on Electronic Transactions) | Not listed | Not listed | INE authorization required under the statistics law |
| Namíbia | none enacted (draft data protection bill under consultation) | Not listed | Not listed | NSA authorization required under the Statistics Act 2011 |
| Somália | not confirmed (draft data protection law reported) | Not listed | Not listed | no formal permit regime confirmed; survey work coordinated with line ministries |
| Sudão do Sul | none identified | Not listed | Not listed | NBS authorization required under the Statistics and Census Act 2015; conflict conditions restrict fieldwork |
| Sudão | none identified | Not listed | Not listed | CBS authorization required under the Statistics Act; conflict conditions restrict fieldwork |
Não classificado no controlo de qualidade da fonte (6)
A lei e o regulador abaixo indicados correspondem ao registado nas fontes oficiais. Não é atribuído qualquer estado.
| País | Lei de proteção de dados | Regulador | É necessário registo? | Órgão de autorização de inquéritos |
|---|---|---|---|---|
| Burquina Faso | Law 010-2017/CNT on the protection of personal data (2017) | CIL (Commission de l'Informatique et des Libertes) | prior declaration to the CIL required | INSD authorization required under the statistics law |
| Costa do Marfim | Law 2013-450 on the protection of personal data (2013) | ARDP (Autorite de Regulation des Donnees a caractere Personnel) | prior declaration to ARDP required | INS authorization required under the statistics law |
| Lesoto | Data Protection Act 2011 (2011) | no dedicated authority operational (Ministry of Communications roles) | registration regime under the Act; enforcement limited | BoS permit required under the Statistics Act 2001 |
| Madagáscar | Law 2014-038 on the protection of personal data (2014) | CNDP (Commission Nationale de l'Informatique et des Libertes, per the law) | declaration regime under the law | INSTAT authorization required under the statistics law |
| Mali | Law 2013-015 on the protection of personal data (2013) | CNDP (Commission Nationale de l'Informatique et des Libertes) | prior authorization/declaration required | INSTAT authorization required under the statistics law |
| Ruanda | Law 058/2021 of 8 October 2021 on personal data protection and privacy (2021) | NCSA (National Cyber Security Authority), data protection and privacy unit | registration of data controllers and processors with NCSA required | NISR authorization required under Law 45/2013 on statistics |
Fontes: o regulador, o instituto de estatística e os textos legais indicados em cada linha, consultados em 10 de outubro de 2026. Consulte os nossos métodos. A planear um inquérito? Fale connosco.
Citar esta página
PollsAfrica (2026). Leis de proteção de dados e autorizações de investigação em África, por país. Consultado em 10 de outubro de 2026 em https://pollsafrica.com/pt/research-rules