#
Treaty is technically in force but enforcement infrastructure and universal ratification remain absent; this is a partial/in-transition continental instrument, not a settled omnibus regime.
Sub-modules (5)
Regulator And AuthorityAmber
No continental DPA exists with enforcement authority. NADPA-RAPDP is a cooperation network established under a constitution reviewed in 2022; it convenes national DPAs but does not itself regulate or enforce.
Claims (7):
- As of the African Union's 8 July 2024 status list, only 16 of 55 AU member states had ratified and deposited instruments for the Malabo Convention, with ratification remaining patchy across the continent.
- NADPA-RAPDP's governing constitution, as amended in May 2022, establishes it as a cooperation and capacity-building network of national data protection authorities rather than a legislative or enforcement body.
- Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection) — only 16 of 55 AU member states had ratified and deposited instruments as of the most recent AU status list, despite entering into force June 2023
- NADPA/RAPDP — A cooperation and capacity-building network, not a legislative or enforcement body, governed by its 2022-reviewed Constitution, with 30+ member DPAs since September 2016
- NADPA/RAPDP is a cooperation and capacity-building network of African data protection authorities, not a legislative or enforcement body, and its existence is not evidence of binding continent-wide data-protection law.
- NADPA/RAPDP — is cooperation network not enforcement body: true
- NADPA/RAPDP is a cooperation and capacity-building network, not a legislative or enforcement authority.
Act And InstrumentsAmber
Malabo Convention is the primary continental instrument; it entered into force 8 June 2023.
Claims (9):
- The Malabo Convention entered into force on 8 June 2023 after Mauritania became the 15th state to submit its ratification, triggering the fifteen-ratification threshold under Article 36.
- The AU's May 2023 status list identified fifteen states that had submitted ratification of the Malabo Convention, including Angola, Ghana, Rwanda, Senegal, Mauritius, and Namibia among others.
- Malabo Convention ratification count — A secondary report dated within the last 10 days states 20 of 55 African countries have now ratified Malabo, a 4-state increase over the AU's July 2024 official count of 16; this figure could not be corroborated against an updated AU official status list this cycle
- NADPA-RAPDP — cooperation and capacity-building network for African DPAs established September 2016, not a legislative or enforcement body
- Malabo Convention — Entered into force 8 June 2023, thirty days after Mauritania's ratification on 9 May 2023 became the 15th instrument of ratification under Article 36
- African Union — 16 of 55 AU member states had ratified/deposited instruments of ratification to the Malabo Convention as at 8 July 2024, with 21 total signatures
- Kenya — Cabinet approved accession to the Malabo Convention in 2025, but as of September 2026 ratification still awaits National Assembly approval; Office of the Data Protection Commissioner opened stakeholder submissions
- African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) — No amendment or new accession to the Malabo Convention with a dated primary source was located within this cycle's window; the most recent dated event on record is Equatorial Guinea's signature (not ratification) on 28 July 2026, which predates this cycle's anchor.
- The Malabo Convention entered into force 8 June 2023 following Mauritania's ratification.
Material ScopeAmber
Convention covers e-commerce, data protection, and cybersecurity/cybercrime but has been criticised for lacking implementation detail.
Claims (1):
- The Malabo Convention aims to create a comprehensive legal framework for electronic commerce, data protection, and cybercrime/cybersecurity, but has drawn criticism that it lacks important detail and does not provide for mechanisms to support its enforcement.
Territorial ScopeAmber
Full domestication mandate applies only once a state ratifies; non-ratifying states are not bound by Convention obligations at the continental level.
Claims (2):
- 20 of 55 AU member states have ratified Malabo as at 2 February 2026; Equatorial Guinea signed without ratifying on 28 July 2026.
- Malabo Convention — 20
Regulator Registration And FilingRed
No continental registration/filing regime exists under the Malabo Convention; any such obligations are set exclusively at national level, which is out of scope for this continent-wide JID. Searched: Malabo Convention treaty text, AU status list, Malabo Roadmap — no continental filing mechanism found.
Regulator & Framework
The African Union Convention on Cyber Security and Personal Data Protection, known as the Malabo Convention, has been in force since 8 June 2023, following the fifteenth ratification required under Article 36 of the treaty. As of a 2 February 2026 African Union status list cited in a 2026 civil-society report, 20 of the African Union's 55 member states have ratified the Convention, with Equatorial Guinea having signed without ratifying on 28 July 2026. This leaves the Convention in force as binding law for its ratifying members while falling well short of continent-wide coverage; several of the continent's largest data-protection markets remain outside the ratifying group, so the Convention cannot be treated as a uniform continental data-protection regime in the way a fully ratified instrument would operate.
The institutional architecture around the Convention is better understood as a cooperation network than as a supranational enforcement body. The Network of African Data Protection Authorities, operating under its reviewed 2022 constitution, is structured to support cooperation and capacity-building among national data-protection authorities rather than to exercise direct enforcement powers of its own. This means that, notwithstanding the Convention's entry into force, there is no continental regulator capable of issuing binding determinations across ratifying states; enforcement authority remains with national data-protection authorities operating under their own domestic legislation, where such legislation exists and has been aligned with the Convention's obligations.
The practical consequence for organisations operating across African jurisdictions is that the Malabo Convention functions as a treaty-level commitment to legislate nationally and cooperate regionally, rather than as a directly applicable, directly enforceable data-protection code. Compliance posture should continue to be assessed primarily at the national level, informed by each ratifying state's domestic implementing legislation, with the Convention serving as the structural backdrop against which that national legislation sits rather than as a substitute for it. Credible commentary has noted that, more than a decade after its original adoption, the treaty continues to face political inertia among a number of larger African economies, which is consistent with the ratification pattern observed in the current status list and is a relevant factor in judging how far the Convention's commitments have actually translated into enforceable national law across the continent.
Outlook
The principal open question is whether the ratification count will move beyond the 20 states confirmed as of the 2 February 2026 status list before the next review point; Equatorial Guinea's July 2026 signature indicates continued, if slow, momentum toward broader participation, but it does not itself add to the ratification count, and whether any further state deposited an instrument of ratification in the period immediately preceding this review could not be confirmed from the sources available. Absent a materially higher ratification count among the continent's larger data-protection markets, the Convention's practical reach is likely to remain narrower than its formal force-of-law status would suggest, and national legislation will continue to be the operative reference point for compliance purposes.
3 earlier distinct update(s)
Regulator & Framework
Africa's data-protection landscape at the continental level is governed by two distinct institutions serving different functions. The Malabo Convention, which entered into force on 8 June 2023 thirty days after Mauritania's ratification on 9 May 2023 became the fifteenth instrument of ratification under Article 36, is the binding legal instrument, while NADPA/RAPDP is a cooperation and capacity-building network governed by its 2022-reviewed constitution, with more than thirty member data-protection authorities participating since September 2016; it is not a legislative or enforcement body in its own right. The African Union's own last published official ratification status, dated 8 July 2024, recorded 16 of 55 member states having ratified or deposited instruments, alongside 21 total signatures. A secondary report circulating within the last ten days claims this figure has since risen to 20 of 55, a four-state increase, but this could not be corroborated against any updated AU official status list; the two figures materially conflict and neither is confirmed to supersede the other. At national level, Kenya shows the practical texture of accession: its Cabinet approved accession to the Convention in 2025, but as of September 2026 ratification still awaits National Assembly approval, with the Office of the Data Protection Commissioner having opened stakeholder submissions on the question.
Outlook
Resolution of the ratification-count discrepancy depends on the African Union publishing an updated official status list; until that occurs, the confirmed 16-of-55 figure from July 2024 should be treated as the standing position. Kenya's progress toward National Assembly ratification, following its 2025 Cabinet approval, is the clearest single national accession process to watch going forward.
Regulator & Framework
Africa's data-protection landscape at the continental level is governed by two distinct institutions serving different functions. The Malabo Convention, which entered into force on 8 June 2023 thirty days after Mauritania's ratification on 9 May 2023 became the fifteenth instrument of ratification under Article 36, is the binding legal instrument, while NADPA/RAPDP is a cooperation and capacity-building network governed by its 2022-reviewed constitution, with more than thirty member data-protection authorities participating since September 2016; it is not a legislative or enforcement body in its own right. The African Union's own last published official ratification status, dated 8 July 2024, recorded 16 of 55 member states having ratified or deposited instruments, alongside 21 total signatures. A secondary report circulating within the last ten days claims this figure has since risen to 20 of 55, a four-state increase, but this could not be corroborated against any updated AU official status list this cycle; the two figures materially conflict and neither is confirmed to supersede the other. At national level, Kenya shows the practical texture of accession: its Cabinet approved accession to the Convention in 2025, but as of September 2026 ratification still awaits National Assembly approval, with the Office of the Data Protection Commissioner having opened stakeholder submissions on the question.
Outlook
Resolution of the ratification-count discrepancy depends on the African Union publishing an updated official status list; until that occurs, the confirmed 16-of-55 figure from July 2024 should be treated as the standing position. Kenya's progress toward National Assembly ratification, following its 2025 Cabinet approval, is the clearest single national accession process to watch going forward.
Regulator & Framework
Africa's continental data protection framework rests on a single treaty instrument, the African Union Convention on Cyber Security and Personal Data Protection, commonly known as the Malabo Convention, which entered into force in June 2023. Confirmed reporting indicates that only 16 of the African Union's 55 member states had ratified and deposited their instruments of ratification as of the most recent African Union status list. This is a materially wide gap between formal treaty force and actual state-level adoption, and it is the central structural fact governing any assessment of continental data protection regulation.
The practical consequence of this ratification gap is that the Malabo Convention cannot be treated as a binding continental data protection law in the way that, for example, a directly applicable regional regulation would function. For the 39 African Union member states that have not yet ratified, the Convention has no binding domestic legal effect regardless of its international force. For the 16 states that have ratified, the Convention's provisions presumably carry the domestic legal weight those states' own constitutional and treaty-incorporation processes assign to it, though the specifics of that domestic incorporation are not detailed in this cycle's evidence.
Supporting this fragmented statutory picture is the Network of African Data Protection Authorities, known as NADPA-RAPDP, which is understood to have been established in September 2016. NADPA-RAPDP's own constitutional documents describe it as a cooperation and capacity-building network for African data protection authorities, and the evidence available this cycle indicates it is not a legislative or enforcement body. This distinction matters for anyone assessing continental regulatory capacity: NADPA-RAPDP provides a forum for African data protection authorities to coordinate and build capacity, but it does not itself have supervisory powers, cannot issue binding decisions, and cannot compel member states toward Malabo ratification or domestication.
Taken together, the regulator-and-framework picture for Africa is one of a treaty with formal international force but limited domestic reach, supported by a cooperation network with no enforcement or legislative function. This leaves the substantive work of data protection regulation to individual national laws and national data protection authorities, each operating independently of any binding continental oversight body. The qualified nature of some of this cycle's findings, particularly around the precise ratification count and the absence of a more developed adequacy mechanism, reflects the genuine difficulty of tracking a fragmented, nationally-driven continental picture from the sources available this cycle.
Outlook
The near-term outlook for continental regulator-and-framework development is one of continuity rather than change. Whether any of the remaining Malabo signatory states will move to ratify before the next reporting cycle is not resolved by this cycle's evidence, and NADPA-RAPDP's cooperation-only mandate gives it no institutional lever to accelerate that process. Absent a new continental initiative not yet reflected in this cycle's sources, the pattern of formal treaty force running well ahead of substantive domestication is likely to persist, with the practical regulatory picture continuing to be set primarily at the national level across the continent's 55 states.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (19)
- Probable African Union — The Malabo Convention entered into force on 8 June 2023 after Mauritania became the 15th state to submit its ratification, triggering the fifteen-ratification threshold under Article 36. observed
- Probable African Union — As of the African Union's 8 July 2024 status list, only 16 of 55 AU member states had ratified and deposited instruments for the Malabo Convention, with ratification remaining patchy across the continent. observed
- Probable NADPA-RAPDP — NADPA-RAPDP's governing constitution, as amended in May 2022, establishes it as a cooperation and capacity-building network of national data protection authorities rather than a legislative or enforcement body. observed
- Probable dataprotection.africa — The AU's May 2023 status list identified fifteen states that had submitted ratification of the Malabo Convention, including Angola, Ghana, Rwanda, Senegal, Mauritius, and Namibia among others. observed
- Probable dataprotection.africa — The Malabo Convention aims to create a comprehensive legal framework for electronic commerce, data protection, and cybercrime/cybersecurity, but has drawn criticism that it lacks important detail and does not provide for mechanisms to support its enforcement. observed
- Probable RFLD 2026 report, Malabo/Budapest/ECOWAS cybercrime treaties — 20 of 55 AU member states have ratified Malabo as at 2 February 2026; Equatorial Guinea signed without ratifying on 28 July 2026. observed
- Disputed NADPA-RAPDP Constitution (reviewed, 2022) — Malabo Convention ratification count — A secondary report dated within the last 10 days states 20 of 55 African countries have now ratified Malabo, a 4-state increase over the AU's July 2024 official count of 16; this figure could not be corroborated against an updated AU official status list this cycle
- Probable RFLD 2026 report, Malabo/Budapest/ECOWAS cybercrime treaties — Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection) — only 16 of 55 AU member states had ratified and deposited instruments as of the most recent AU status list, despite entering into force June 2023 observed
- Probable NADPA-RAPDP Constitution (reviewed, 2022) — NADPA-RAPDP — cooperation and capacity-building network for African DPAs established September 2016, not a legislative or enforcement body
- Probable Malabo Convention, official treaty text — NADPA/RAPDP — A cooperation and capacity-building network, not a legislative or enforcement body, governed by its 2022-reviewed Constitution, with 30+ member DPAs since September 2016
- Probable RFLD 2026 report, Malabo/Budapest/ECOWAS cybercrime treaties — Malabo Convention — Entered into force 8 June 2023, thirty days after Mauritania's ratification on 9 May 2023 became the 15th instrument of ratification under Article 36 observed
- Probable African Union Infrastructure & Energy (official account) — African Union — 16 of 55 AU member states had ratified/deposited instruments of ratification to the Malabo Convention as at 8 July 2024, with 21 total signatures observed
- Probable Streamlinefeed — Kenya — Cabinet approved accession to the Malabo Convention in 2025, but as of September 2026 ratification still awaits National Assembly approval; Office of the Data Protection Commissioner opened stakeholder submissions observed
- Probable Nigeria Data Protection Commission — NADPA/RAPDP is a cooperation and capacity-building network of African data protection authorities, not a legislative or enforcement body, and its existence is not evidence of binding continent-wide data-protection law. observed
- Probable https://x.com/au_ied/status/2082513718823305272 — African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) — No amendment or new accession to the Malabo Convention with a dated primary source was located within this cycle's window; the most recent dated event on record is Equatorial Guinea's signature (not ratification) on 28 July 2026, which predates this cycle's anchor.
- Probable RFLD 2026 report, Malabo/Budapest/ECOWAS cybercrime treaties — Malabo Convention — 20 observed
- Probable NADPA-RAPDP Constitution (reviewed, 2022) — NADPA/RAPDP — is cooperation network not enforcement body: true
- Probable Malabo Convention, official treaty text — The Malabo Convention entered into force 8 June 2023 following Mauritania's ratification.
- Probable NADPA-RAPDP Constitution (reviewed, 2022) — NADPA/RAPDP is a cooperation and capacity-building network, not a legislative or enforcement authority.