Public data
Data protection laws and research permits in Africa, by country
Who authorizes a survey, which data protection law applies and who regulates it, for 54 African countries.
How to use this
Planning fieldwork in Africa usually means two checks. First, find out which body must authorize the survey, often the national statistics office. Second, check whether the country has a data protection law, who regulates it, and whether you must register before you collect personal data. Find your country in the table, then open its page for the links to the regulator, the permit body and the statistics office. Where a field has no official entry, the table shows "Not listed".
Summary for planning; confirm requirements with the regulator before fieldwork.
- 23 operational regulator
- 13 law adopted, regulator not confirmed operational
- 12 no law identified
- 6 not classified in source QA
Operational regulator (23)
A data protection law is in force and a regulator is working.
| Country | Data protection law | Regulator | Registration needed? | Survey permit body |
|---|---|---|---|---|
| Algeria | Law 18-07 on the protection of natural persons in the processing of personal data (2018) | ANPDP (Autorite Nationale de Protection des Donnees a caractere Personnel) | prior declaration or authorization for processing | ONS authorization required under the statistics law |
| Benin | Law 2017-20 on the digital code (personal data protection section) (2017) | APDP (Autorite de Protection des Donnees a caractere Personnel) | declaration to APD required before processing | INStaD authorization required under Law 2010-35 on statistics |
| Botswana | Data Protection Act 2018 (Act 32 of 2018) (2018) | Data Protection Commissioner (Office of the Data Protection Commissioner) | registration of data controllers and processors required | Statistics Botswana permit required under the Statistics Act 2009 |
| Cabo Verde | Law 133/VI/2001 on personal data protection, amended by Law 57/VIII/2021 (2001) | CNPD (Comissao Nacional de Protecao de Dados) | notification to CNPD required for processing | INE authorization required under the statistics law (Lei 50/VI/2005 as amended) |
| Egypt | Law 151 of 2020 on the protection of personal data (2020) | Egyptian Data Protection Centre (EDPC) under MCIT | licensing/registration of data processing platforms via EDPC | CAPMAS permit required under Law 175 of 2018 on statistics |
| Gabon | Law 001/2011 on data protection in electronic communications (2011) | CNPD (Commission Nationale de Protection des Donnees) | declaration to CNPD required | DGS authorization required under the statistics law |
| Gambia | Data Protection Act 2021 (2021) | Data Protection Commission (established 2023) | registration of data controllers and processors required | GBoS permit required under the Statistics Act 2005 |
| Ghana | Data Protection Act 2012 (Act 843) (2012) | Data Protection Commission (Ghana) | registration of data controllers required | GSS permit required under the Statistical Service Act 2019 (Act 1003) |
| Kenya | Data Protection Act 2019 (2019) | Office of the Data Protection Commissioner (ODPC) | registration of data controllers and processors required (exemptions by regulation) | KNBS research license required under the Statistics Act 2006 (research license regime) |
| Malawi | Data Protection Act 2024 (Act 6 of 2024) (2024) | Data Protection Authority (provided for by the Act) | registration regime under the Act; authority being stood up | NSO permit required under the Statistics Act 2013 |
| Mauritania | Law 2017-020 of 22 July 2017 on personal data protection (2017) | APD (Autorite de Protection des Donnees a caractere Personnel), operational since decree 2022-13 of 18 February 2022 | declaration/authorization regime before the APD | ONS authorization required under Ordinance 2005-026 on statistics |
| Mauritius | Data Protection Act 2017 (2017) | Data Protection Office | registration of data controllers required | Statistics Mauritius authorization required under the Statistics Act 2000 |
| Morocco | Law 09-08 on the protection of individuals with regard to personal data processing (2009) | CNDP (Commission Nationale de controle de la protection des Donnees a caractere personnel) | prior declaration to CNDP required | HCP authorization required under Law 06-99 on statistics |
| Nigeria | Nigeria Data Protection Act 2023 (2023) | Nigeria Data Protection Commission (NDPC) | registration of data controllers of major importance required | NBS permit required for statistical surveys; NDPC clearance for personal data processing in research |
| Senegal | Law 2008-12 on personal data protection (2008) | CDP (Commission de protection des Donnees personnelles) | prior declaration to CDP required | ANSD authorization required under Law 2004-21 on statistics |
| Seychelles | Data Protection Act 2003, amended by the Data Protection (Amendment) Act 2023 (2003) | Information Commissioner's Office | notification/registration regime under the Act | NBS authorization required under the Statistics Act 2000 |
| Sierra Leone | Data Protection Act 2021 (Act 5 of 2021) (2021) | National Data Protection Commission (NDPC) | registration of data controllers required | SSL permit required under the Statistics Act 2002 |
| South Africa | Protection of Personal Information Act 4 of 2013 (POPIA) (2013) | Information Regulator (South Africa) | registration of information officers required; deputy information officers for research bodies | Stats SA accreditation required for research access; ethical clearance via research ethics bodies |
| Togo | Law 2019-014 of 29 October 2019 on personal data protection (2019) | IPDCP (Instance de Protection des Donnees a Caractere Personnel) | declaration to IPDCP required; designated data correspondents exempted from prior formalities | DGSCN authorization required under the statistics law |
| Tunisia | Organic Law 2004-63 on personal data processing (2004) | INPDP (Instance Nationale de Protection des Donnees a Caractere Personnel) | prior authorization by INPDP required | INS authorization required under Law 1964-93 on statistics |
| Uganda | Data Protection and Privacy Act 2019 (2019) | Personal Data Protection Office (PDPO) | registration of data controllers and processors required | UBOS clearance required under the Uganda Bureau of Statistics Act 1998; research also requires UNCST registration |
| Zambia | Data Protection Act No. 3 of 2021 (2021) | Data Protection Commissioner (under the Ministry of Technology and Science) | registration of data controllers and processors required | ZamStats permit required under the Statistics Act 2018 |
| Zimbabwe | Cyber and Data Protection Act 2021 (Act 5 of 2021) (2021) | Data Protection Authority provided for by the Act; operational status limited | registration of data controllers under the Act | ZIMSTAT permit required under the Census and Statistics Act 2017 |
Law adopted, regulator not confirmed operational (13)
A law is adopted. A working regulator is not yet on record.
| Country | Data protection law | Regulator | Registration needed? | Survey permit body |
|---|---|---|---|---|
| Angola | Law 22/11 of 17 June 2011 on personal data protection (2011) | Agencia de Protecao de Dados (APD) | prior authorization by the APD for processing | INE authorization required under the statistics framework law |
| Burundi | Law 1/09 on the protection of personal data (reported) (2009) | not confirmed (no operational authority identified) | not confirmed | ISTEEBU authorization required under Law 1/015 of 2009 on statistics |
| Cameroon | Law 2024/017 of 23 December 2024 on personal data protection (2024) | authority provided for by the 2024 law; implementation decrees pending (not confirmed) | declaration/authorization regime under the 2024 law; modalities pending | BUCREP authorization required for censuses and population studies; NSO function shared with INS |
| Chad | Law 020/PR/2015 on cybersecurity and data protection (reported) (2015) | not confirmed (no operational authority identified) | prior declaration regime under the law; implementation unclear | INSEED authorization required under Law 05-17 of 2005 on statistics |
| Congo | Law 29-2019 of 28 October 2019 on personal data protection (2019) | Commission de Controle et de Protection des Donnees a caractere Personnel (provided for by the law) | prior declaration to the authority required | CNSEE authorization required under Law 14-94 on statistics |
| Democratic Republic of the Congo | Law 20/017 of 8 July 2020 on personal data protection (2020) | Autorite de Protection des Donnees a caractere Personnel (provided for by the law) | prior declaration/authorization regime under Law 20/017 | INS authorization required under the statistics law (Loi 81-006) |
| Equatorial Guinea | Law 1/2016 on the protection of personal data (2016) | Organo Rector de Proteccion de Datos Personales (provided for by the law) | registry of data files (Registro General de Proteccion de Datos Personales) under the law | INE authorization required; regime not confirmed in practice |
| Eswatini | Data Protection Act, 2022 (reported) (2022) | Data Protection Commissioner (provided for by the Act) | registration regime under the Act; implementation not confirmed | CSO permit required under the Statistics Act 1967 (as amended) |
| Ethiopia | Personal Data Protection Proclamation No. 1321/2024 (2024) | provided for under the proclamation (Ethiopian Communications Authority roles); details pending | registration/notification regime under the proclamation; implementing rules pending | ESS authorization required under the Ethiopian Statistics Service Proclamation 1262/2021 |
| Guinea | Law 2016-037/AN on cybersecurity and personal data protection (2016) | authority provided for by regulatory decree; establishment not confirmed effective | prior declaration or authorization required by law; implementing decree pending | INS authorization required under the statistics law |
| Niger | Law 2017-64 on the protection of personal data (2017) | CNDP (Commission Nationale de Protection des Donnees a caractere Personnel) | declaration/authorization regime under the law | INS authorization required under Law 2015-25 on statistics |
| Sao Tome and Principe | not confirmed (no comprehensive law identified) | Not listed | Not listed | INE authorization required under the statistics framework law |
| Tanzania | Personal Data Protection Act 2022 (Act 11 of 2022) (2022) | data protection authority provided for by the Act; operational status not confirmed | registration regime under the Act | NBS permit required under the Statistics Act 2015 |
No law identified (12)
No national data protection law is on record.
| Country | Data protection law | Regulator | Registration needed? | Survey permit body |
|---|---|---|---|---|
| Central African Republic | not confirmed (no comprehensive law identified) | Not listed | Not listed | no formal permit regime confirmed; field research requires government authorization in practice |
| Comoros | not confirmed (no comprehensive law identified) | Not listed | Not listed | INSEED authorization required under the statistics law |
| Djibouti | not confirmed (no comprehensive law identified) | Not listed | Not listed | authorization from the statistics department required; regime not confirmed |
| Eritrea | none identified | Not listed | Not listed | no formal research permit regime; independent field research is effectively not permitted |
| Guinea-Bissau | none identified | Not listed | Not listed | INE authorization required under the statistics framework law (Lei 9/2012, confirmed via AFRISTAT mirror) |
| Liberia | none enacted (draft data protection bill pending) | Not listed | Not listed | LISGIS permit required under the Statistics and Geo-Information Act 2019 |
| Libya | none identified (cybercrime law 2022 contains partial provisions) | Not listed | Not listed | no functioning permit regime confirmed |
| Mozambique | no comprehensive law identified (partial provisions in the 2017 Law on Electronic Transactions) | Not listed | Not listed | INE authorization required under the statistics law |
| Namibia | none enacted (draft data protection bill under consultation) | Not listed | Not listed | NSA authorization required under the Statistics Act 2011 |
| Somalia | not confirmed (draft data protection law reported) | Not listed | Not listed | no formal permit regime confirmed; survey work coordinated with line ministries |
| South Sudan | none identified | Not listed | Not listed | NBS authorization required under the Statistics and Census Act 2015; conflict conditions restrict fieldwork |
| Sudan | none identified | Not listed | Not listed | CBS authorization required under the Statistics Act; conflict conditions restrict fieldwork |
Not classified in source QA (6)
The law and regulator below are as recorded in the official sources. No status is assigned.
| Country | Data protection law | Regulator | Registration needed? | Survey permit body |
|---|---|---|---|---|
| Burkina Faso | Law 010-2017/CNT on the protection of personal data (2017) | CIL (Commission de l'Informatique et des Libertes) | prior declaration to the CIL required | INSD authorization required under the statistics law |
| Cote d'Ivoire | Law 2013-450 on the protection of personal data (2013) | ARDP (Autorite de Regulation des Donnees a caractere Personnel) | prior declaration to ARDP required | INS authorization required under the statistics law |
| Lesotho | Data Protection Act 2011 (2011) | no dedicated authority operational (Ministry of Communications roles) | registration regime under the Act; enforcement limited | BoS permit required under the Statistics Act 2001 |
| Madagascar | Law 2014-038 on the protection of personal data (2014) | CNDP (Commission Nationale de l'Informatique et des Libertes, per the law) | declaration regime under the law | INSTAT authorization required under the statistics law |
| Mali | Law 2013-015 on the protection of personal data (2013) | CNDP (Commission Nationale de l'Informatique et des Libertes) | prior authorization/declaration required | INSTAT authorization required under the statistics law |
| Rwanda | Law 058/2021 of 8 October 2021 on personal data protection and privacy (2021) | NCSA (National Cyber Security Authority), data protection and privacy unit | registration of data controllers and processors with NCSA required | NISR authorization required under Law 45/2013 on statistics |
Sources: the regulator, statistics office and legal texts linked in each row, retrieved 10 Oct 2026. See our methods. Planning a survey? Talk to us.