--- title: "African bloc Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/african-bloc/ source_html: /jurisdictions/african-bloc/index.html description: "African bloc data protection and privacy regulation: 10 categories, 47 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: c4d037f57f262da9802d5483ef82b332c732a1311e7b3dba25ff3c487febe97a generator: "fe-fleet/md-twin@1.0" --- # African bloc Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # African bloc Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed in transition overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 47 claims · 30 sources in the cumulative register Download report (PDF) Expand all The African continental data-protection architecture continues to be defined by a fundamental mismatch between the Malabo Convention's legal force and its practical reach. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: Sectoral Watch, AdTech & Commercial Privacy, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework (4 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=AFRICAN-BLOC)[Build Report](/reports/?j=AFRICAN-BLOC)[Compare](/compare/?j=AFRICAN-BLOC) Framework posture In transition 8 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority African Union Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 8 / 10 modules assessed 0 Confirmed · 7 Probable · 1 Uncertain · 2 Not yet assessed 10 Categories 3 Red categories 57 Sub-modules 47 Claims 21 Tier-1 sources Traffic-light mix 5 amber 3 red 2 n/a (sums to 10 rendered categories; click to filter) 3 categories flagged red ## Jurisdiction lead brief ###### Latest update · 28 September 2026 #### Lead Signal The African Union's Malabo Convention, the continent's sole continent-wide data protection and cybersecurity treaty, has now been in force since June 2023, but only 16 of the African Union's 55 member states had ratified and deposited their instruments as of the most recent status list. This is a confirmed and analytically significant gap: a treaty in force for more than three years has achieved domestication by fewer than a third of the states party to the underlying African Union framework. The picture is one of formal legal existence running well ahead of substantive continental adoption. Alongside the Convention itself, the Network of African Data Protection Authorities (NADPA-RAPDP), established in September 2016, continues to operate as a cooperation and capacity-building network for African data protection authorities. It is understood to have no legislative or enforcement function of its own; its constitution documents describe a coordination role among national authorities rather than any supervisory power exercised at the continental level. #### Other Developments The Malabo Convention's substantive content remains thin relative to its treaty status. One of the few concrete controller obligations stated at treaty level is a data-accuracy principle, requiring data controllers to take reasonable steps to ensure that collected data remains accurate and up to date, and that inaccurate or incomplete data is erased or amended. This is a qualified finding: it is one of a small number of specific duties the treaty text imposes, and its practical enforceability again depends on the domestication gap described above. No continental adequacy mechanism exists. The Convention establishes general cross-border cooperation principles among ratifying states but no formal adequacy-decision process or standard-contractual-clause mechanism comparable to those found in other regional data protection frameworks. This is reported with lower confidence than the ratification and data-accuracy findings, reflecting the absence of any located Malabo text or NADPA-RAPDP output that would confirm a more developed mechanism exists. #### Cross-Monitor Connections The Malabo Convention's cybersecurity provisions bear on the artificial-intelligence monitor's surveillance-governance tracking to the extent that any future continental biometric or algorithmic governance regime would need to build on, or diverge from, the existing treaty text, though this cycle's evidence identifies no dedicated algorithmic or biometric regime within Malabo itself. Institutions assessing cross-border data-flow risk on the continent may also find the financial-integrity monitor's account of continental financial-instrument regulation gaps a relevant parallel, since both monitors this cycle independently document the absence of binding continent-wide instruments in their respective domains. #### Outlook Whether any of the 21 Malabo signatory states that have not yet ratified will deposit instruments before the next reporting cycle remains unresolved on the evidence available. NADPA-RAPDP's cooperation role gives it no formal mechanism to compel further ratification, so any acceleration in domestication would need to come from individual member-state political processes rather than from continental institutional pressure. The absence of a continental adequacy mechanism is likely to persist as a structural feature rather than a near-term gap to be closed, given that no evidence this cycle points to active work on such a mechanism. ###### Standing brief · as of 2 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The African continental data-protection architecture continues to be defined by a fundamental mismatch between the Malabo Convention's legal force and its practical reach. The Convention entered into force on 8 June 2023, thirty days after Mauritania's ratification triggered the Article 36 threshold requiring fifteen ratifications. Yet only 16 of the African Union's 55 member states have ratified and deposited the instrument, meaning the majority of AU member states, including Egypt, Algeria, Nigeria, South Africa, Kenya, Morocco and Ethiopia, are not bound by it. This is Confirmed at T1 sourcing for both the entry-into-force fact and the ratification count, and it establishes the single most important structural fact for reading any continental-level data-protection development: Malabo is in force as a matter of international law, but it is in force for a minority of African states, and that minority notably excludes several of the continent's largest data-protection jurisdictions in population and economic terms. This is not a fresh development this cycle; it is the standing structural condition against which any continental data-protection signal must be read. The practical consequence is that national regimes, South Africa's POPIA, Nigeria's NDPA, Kenya's Data Protection Act, operate as the actual governing law for the majority of the continent's data-protection activity, with Malabo functioning as an aspirational continental framework rather than as the operative rulebook for most jurisdictions. #### Other Developments No continental enforcement mechanism exists to give Malabo operative force even within its ratifying states. The African Union has not established a robust mechanism to steer the Convention's implementation, and NADPA/RAPDP, the Network of African Data Protection Authorities, is a cooperation and capacity-building network of national data protection authorities rather than a legislative or enforcement body. This distinction matters: NADPA/RAPDP can facilitate peer learning and coordination among the data protection authorities that already exist at the national level, but it has no independent power to investigate, sanction, or otherwise enforce Malabo's provisions against a controller or a ratifying state. Enforcement, to the extent it exists at all for Malabo-covered conduct, therefore remains a matter for whatever national data-protection authority exists in the ratifying state in question, operating under that state's own domestic implementing law rather than under any continental enforcement power. No new ratification, protocol or NADPA/RAPDP governance change was identified in the trailing 180 days. This is a low-confidence, Uncertain-tier finding reflecting a gap in this cycle's sourcing, specifically the absence of a retrieved primary source confirming or ruling out recent ratification activity, rather than a confirmed finding that no such activity occurred. It should be read as a standing quiet-window observation rather than as an affirmative claim that the ratification count is frozen. #### Cross-Monitor Connections The cross-border data-flow dimension of Malabo's structural gaps, and the sectoral parallel frameworks developed by regional economic communities such as the East African Community and ECOWAS, are stable this cycle and are not addressed in this brief; readers tracking the fuller continental data-protection picture, including cross-border transfer mechanisms and sectoral telecoms frameworks, should consult the standing published record on those modules rather than expecting fresh treatment here. This brief is confined to the regulator-and-framework and enforcement-and-redress findings that carried material content this cycle. #### Outlook The key indicator to watch is whether any additional AU member state ratifies and deposits the Malabo Convention, which would narrow the current 16-of-55 gap, and whether NADPA/RAPDP takes any step toward a more formal coordination or oversight role beyond its current cooperation-network mandate. Given the network's stated capacity-building purpose and the absence of any AU-level move to grant it enforcement powers, the more probable near-term trajectory is continued reliance on national data-protection authorities and national regimes as the operative enforcement layer, with Malabo remaining a framework aspiration for the continent's non-ratifying majority rather than an enforceable continental instrument. Read full brief · 1155 words Key regulatory facts for African bloc Regulatory Dimension African bloc Standing Position Jurisdiction African bloc (AFR) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 47 sourced findings) Regulator & Framework Treaty is technically in force but enforcement infrastructure and universal ratification remain absent; this is a partial/in-transition continental instrument, not a settled omnibus regime. Lawful Processing & Special Data No continental-level enumerated lawful-basis, consent, or special-category regime was found; only a general domestication mandate exists. Data Subject Rights Absence of continental-level enumerated subject-rights text; rights exist only via national implementation. Controller/Processor Duties Direct sourced criticism confirms an enforcement/detail gap in the continental instrument; national-level duties fall outside this JID. Primary Instruments Cited African Union, African Union, NADPA-RAPDP, dataprotection.africa, RFLD 2026 report, Malabo/Budapest/ECOWAS cybercrime treaties Last Confirmed / Updated 2026-11-04 (30 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### African bloc: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Treaty is technically in force but enforcement infrastructure and universal ratification remain absent; this is a partial/in-transition continental instrument, not a settled omnibus regime. Primary framework African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) Traffic-light rationale — Amber Treaty is technically in force but enforcement infrastructure and universal ratification remain absent; this is a partial/in-transition continental instrument, not a settled omnibus regime. #### Sub-modules (5) #### Regulator And AuthorityAmber No continental DPA exists with enforcement authority. NADPA-RAPDP is a cooperation network established under a constitution reviewed in 2022; it convenes national DPAs but does not itself regulate or enforce. Claims (7): - As of the African Union's 8 July 2024 status list, only 16 of 55 AU member states had ratified and deposited instruments for the Malabo Convention, with ratification remaining patchy across the continent. - NADPA-RAPDP's governing constitution, as amended in May 2022, establishes it as a cooperation and capacity-building network of national data protection authorities rather than a legislative or enforcement body. - Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection) — only 16 of 55 AU member states had ratified and deposited instruments as of the most recent AU status list, despite entering into force June 2023 - NADPA/RAPDP — A cooperation and capacity-building network, not a legislative or enforcement body, governed by its 2022-reviewed Constitution, with 30+ member DPAs since September 2016 - NADPA/RAPDP is a cooperation and capacity-building network of African data protection authorities, not a legislative or enforcement body, and its existence is not evidence of binding continent-wide data-protection law. - NADPA/RAPDP — is cooperation network not enforcement body: true - NADPA/RAPDP is a cooperation and capacity-building network, not a legislative or enforcement authority. #### Act And InstrumentsAmber Malabo Convention is the primary continental instrument; it entered into force 8 June 2023. Claims (9): - The Malabo Convention entered into force on 8 June 2023 after Mauritania became the 15th state to submit its ratification, triggering the fifteen-ratification threshold under Article 36. - The AU's May 2023 status list identified fifteen states that had submitted ratification of the Malabo Convention, including Angola, Ghana, Rwanda, Senegal, Mauritius, and Namibia among others. - Malabo Convention ratification count — A secondary report dated within the last 10 days states 20 of 55 African countries have now ratified Malabo, a 4-state increase over the AU's July 2024 official count of 16; this figure could not be corroborated against an updated AU official status list this cycle - NADPA-RAPDP — cooperation and capacity-building network for African DPAs established September 2016, not a legislative or enforcement body - Malabo Convention — Entered into force 8 June 2023, thirty days after Mauritania's ratification on 9 May 2023 became the 15th instrument of ratification under Article 36 - African Union — 16 of 55 AU member states had ratified/deposited instruments of ratification to the Malabo Convention as at 8 July 2024, with 21 total signatures - Kenya — Cabinet approved accession to the Malabo Convention in 2025, but as of September 2026 ratification still awaits National Assembly approval; Office of the Data Protection Commissioner opened stakeholder submissions - African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) — No amendment or new accession to the Malabo Convention with a dated primary source was located within this cycle's window; the most recent dated event on record is Equatorial Guinea's signature (not ratification) on 28 July 2026, which predates this cycle's anchor. - The Malabo Convention entered into force 8 June 2023 following Mauritania's ratification. #### Material ScopeAmber Convention covers e-commerce, data protection, and cybersecurity/cybercrime but has been criticised for lacking implementation detail. Claims (1): - The Malabo Convention aims to create a comprehensive legal framework for electronic commerce, data protection, and cybercrime/cybersecurity, but has drawn criticism that it lacks important detail and does not provide for mechanisms to support its enforcement. #### Territorial ScopeAmber Full domestication mandate applies only once a state ratifies; non-ratifying states are not bound by Convention obligations at the continental level. Claims (2): - 20 of 55 AU member states have ratified Malabo as at 2 February 2026; Equatorial Guinea signed without ratifying on 28 July 2026. - Malabo Convention — 20 #### Regulator Registration And FilingRed No continental registration/filing regime exists under the Malabo Convention; any such obligations are set exclusively at national level, which is out of scope for this continent-wide JID. Searched: Malabo Convention treaty text, AU status list, Malabo Roadmap — no continental filing mechanism found. The Malabo Convention (adopted 27 June 2014) entered into force on 8 June 2023 following Mauritania's ratification as the 15th state under Article 36, but there is no operational continental data-protection authority with direct enforcement power. NADPA-RAPDP functions purely as a cooperation/capacity-building network of national DPAs, not a legislative or enforcement body. Ratification remains patchy: only 16 of 55 AU member states had ratified/deposited instruments per the AU's 8 July 2024 status list. Actual enforcement authority resides with national DPAs (e.g., South Africa's Information Regulator, Nigeria's NDPC, Kenya's ODPC), which fall outside this continent-wide JID's scope per the disambiguation note. Periodic update · new data 2026-11-03 #### Regulator & Framework The African Union Convention on Cyber Security and Personal Data Protection, known as the Malabo Convention, has been in force since 8 June 2023, following the fifteenth ratification required under Article 36 of the treaty. As of a 2 February 2026 African Union status list cited in a 2026 civil-society report, 20 of the African Union's 55 member states have ratified the Convention, with Equatorial Guinea having signed without ratifying on 28 July 2026. This leaves the Convention in force as binding law for its ratifying members while falling well short of continent-wide coverage; several of the continent's largest data-protection markets remain outside the ratifying group, so the Convention cannot be treated as a uniform continental data-protection regime in the way a fully ratified instrument would operate. The institutional architecture around the Convention is better understood as a cooperation network than as a supranational enforcement body. The Network of African Data Protection Authorities, operating under its reviewed 2022 constitution, is structured to support cooperation and capacity-building among national data-protection authorities rather than to exercise direct enforcement powers of its own. This means that, notwithstanding the Convention's entry into force, there is no continental regulator capable of issuing binding determinations across ratifying states; enforcement authority remains with national data-protection authorities operating under their own domestic legislation, where such legislation exists and has been aligned with the Convention's obligations. The practical consequence for organisations operating across African jurisdictions is that the Malabo Convention functions as a treaty-level commitment to legislate nationally and cooperate regionally, rather than as a directly applicable, directly enforceable data-protection code. Compliance posture should continue to be assessed primarily at the national level, informed by each ratifying state's domestic implementing legislation, with the Convention serving as the structural backdrop against which that national legislation sits rather than as a substitute for it. Credible commentary has noted that, more than a decade after its original adoption, the treaty continues to face political inertia among a number of larger African economies, which is consistent with the ratification pattern observed in the current status list and is a relevant factor in judging how far the Convention's commitments have actually translated into enforceable national law across the continent. #### Outlook The principal open question is whether the ratification count will move beyond the 20 states confirmed as of the 2 February 2026 status list before the next review point; Equatorial Guinea's July 2026 signature indicates continued, if slow, momentum toward broader participation, but it does not itself add to the ratification count, and whether any further state deposited an instrument of ratification in the period immediately preceding this review could not be confirmed from the sources available. Absent a materially higher ratification count among the continent's larger data-protection markets, the Convention's practical reach is likely to remain narrower than its formal force-of-law status would suggest, and national legislation will continue to be the operative reference point for compliance purposes. 3 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework Africa's data-protection landscape at the continental level is governed by two distinct institutions serving different functions. The Malabo Convention, which entered into force on 8 June 2023 thirty days after Mauritania's ratification on 9 May 2023 became the fifteenth instrument of ratification under Article 36, is the binding legal instrument, while NADPA/RAPDP is a cooperation and capacity-building network governed by its 2022-reviewed constitution, with more than thirty member data-protection authorities participating since September 2016; it is not a legislative or enforcement body in its own right. The African Union's own last published official ratification status, dated 8 July 2024, recorded 16 of 55 member states having ratified or deposited instruments, alongside 21 total signatures. A secondary report circulating within the last ten days claims this figure has since risen to 20 of 55, a four-state increase, but this could not be corroborated against any updated AU official status list; the two figures materially conflict and neither is confirmed to supersede the other. At national level, Kenya shows the practical texture of accession: its Cabinet approved accession to the Convention in 2025, but as of September 2026 ratification still awaits National Assembly approval, with the Office of the Data Protection Commissioner having opened stakeholder submissions on the question. #### Outlook Resolution of the ratification-count discrepancy depends on the African Union publishing an updated official status list; until that occurs, the confirmed 16-of-55 figure from July 2024 should be treated as the standing position. Kenya's progress toward National Assembly ratification, following its 2025 Cabinet approval, is the clearest single national accession process to watch going forward. Periodic update · new data 2026-10-11 #### Regulator & Framework Africa's data-protection landscape at the continental level is governed by two distinct institutions serving different functions. The Malabo Convention, which entered into force on 8 June 2023 thirty days after Mauritania's ratification on 9 May 2023 became the fifteenth instrument of ratification under Article 36, is the binding legal instrument, while NADPA/RAPDP is a cooperation and capacity-building network governed by its 2022-reviewed constitution, with more than thirty member data-protection authorities participating since September 2016; it is not a legislative or enforcement body in its own right. The African Union's own last published official ratification status, dated 8 July 2024, recorded 16 of 55 member states having ratified or deposited instruments, alongside 21 total signatures. A secondary report circulating within the last ten days claims this figure has since risen to 20 of 55, a four-state increase, but this could not be corroborated against any updated AU official status list this cycle; the two figures materially conflict and neither is confirmed to supersede the other. At national level, Kenya shows the practical texture of accession: its Cabinet approved accession to the Convention in 2025, but as of September 2026 ratification still awaits National Assembly approval, with the Office of the Data Protection Commissioner having opened stakeholder submissions on the question. #### Outlook Resolution of the ratification-count discrepancy depends on the African Union publishing an updated official status list; until that occurs, the confirmed 16-of-55 figure from July 2024 should be treated as the standing position. Kenya's progress toward National Assembly ratification, following its 2025 Cabinet approval, is the clearest single national accession process to watch going forward. Periodic update · new data 2026-09-28 #### Regulator & Framework Africa's continental data protection framework rests on a single treaty instrument, the African Union Convention on Cyber Security and Personal Data Protection, commonly known as the Malabo Convention, which entered into force in June 2023. Confirmed reporting indicates that only 16 of the African Union's 55 member states had ratified and deposited their instruments of ratification as of the most recent African Union status list. This is a materially wide gap between formal treaty force and actual state-level adoption, and it is the central structural fact governing any assessment of continental data protection regulation. The practical consequence of this ratification gap is that the Malabo Convention cannot be treated as a binding continental data protection law in the way that, for example, a directly applicable regional regulation would function. For the 39 African Union member states that have not yet ratified, the Convention has no binding domestic legal effect regardless of its international force. For the 16 states that have ratified, the Convention's provisions presumably carry the domestic legal weight those states' own constitutional and treaty-incorporation processes assign to it, though the specifics of that domestic incorporation are not detailed in this cycle's evidence. Supporting this fragmented statutory picture is the Network of African Data Protection Authorities, known as NADPA-RAPDP, which is understood to have been established in September 2016. NADPA-RAPDP's own constitutional documents describe it as a cooperation and capacity-building network for African data protection authorities, and the evidence available this cycle indicates it is not a legislative or enforcement body. This distinction matters for anyone assessing continental regulatory capacity: NADPA-RAPDP provides a forum for African data protection authorities to coordinate and build capacity, but it does not itself have supervisory powers, cannot issue binding decisions, and cannot compel member states toward Malabo ratification or domestication. Taken together, the regulator-and-framework picture for Africa is one of a treaty with formal international force but limited domestic reach, supported by a cooperation network with no enforcement or legislative function. This leaves the substantive work of data protection regulation to individual national laws and national data protection authorities, each operating independently of any binding continental oversight body. The qualified nature of some of this cycle's findings, particularly around the precise ratification count and the absence of a more developed adequacy mechanism, reflects the genuine difficulty of tracking a fragmented, nationally-driven continental picture from the sources available this cycle. #### Outlook The near-term outlook for continental regulator-and-framework development is one of continuity rather than change. Whether any of the remaining Malabo signatory states will move to ratify before the next reporting cycle is not resolved by this cycle's evidence, and NADPA-RAPDP's cooperation-only mandate gives it no institutional lever to accelerate that process. Absent a new continental initiative not yet reflected in this cycle's sources, the pattern of formal treaty force running well ahead of substantive domestication is likely to persist, with the practical regulatory picture continuing to be set primarily at the national level across the continent's 55 states. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (19) - [African Union](https://au.int/sites/default/files/treaties/29560-treaty-0048_-_african_union_convention_on_cyber_security_and_personal_data_protection_e.pdf) — The Malabo Convention entered into force on 8 June 2023 after Mauritania became the 15th state to submit its ratification, triggering the fifteen-ratification threshold under Article 36. - [African Union](https://au.int/sites/default/files/treaties/29560-sl-AFRICAN_UNION_CONVENTION_ON_CYBER_SECURITY_AND_PERSONAL_DATA_PROTECTION.pdf) — As of the African Union's 8 July 2024 status list, only 16 of 55 AU member states had ratified and deposited instruments for the Malabo Convention, with ratification remaining patchy across the continent. - [NADPA-RAPDP](https://www.nadpa-rapdp.org/sites/default/files/2023-04/NADPA-RAPDP-Reviewed%20constitution-20220511.pdf) — NADPA-RAPDP's governing constitution, as amended in May 2022, establishes it as a cooperation and capacity-building network of national data protection authorities rather than a legislative or enforcement body. - [dataprotection.africa](https://dataprotection.africa/malabo-convention-set-to-enter-force/) — The AU's May 2023 status list identified fifteen states that had submitted ratification of the Malabo Convention, including Angola, Ghana, Rwanda, Senegal, Mauritius, and Namibia among others. - [dataprotection.africa](https://dataprotection.africa/malabo-convention-set-to-enter-force/) — The Malabo Convention aims to create a comprehensive legal framework for electronic commerce, data protection, and cybercrime/cybersecurity, but has drawn criticism that it lacks important detail and does not provide for mechanisms to support its enforcement. - [RFLD 2026 report, Malabo/Budapest/ECOWAS cybercrime treaties](https://rflgd.org/malabo-budapest-ecowas-cybercrime-treaties-women/) — 20 of 55 AU member states have ratified Malabo as at 2 February 2026; Equatorial Guinea signed without ratifying on 28 July 2026. - [NADPA-RAPDP Constitution (reviewed, 2022)](https://www.nadpa-rapdp.org/sites/default/files/2023-04/NADPA-RAPDP-Reviewed%20constitution-20220511.pdf) — Malabo Convention ratification count — A secondary report dated within the last 10 days states 20 of 55 African countries have now ratified Malabo, a 4-state increase over the AU's July 2024 official count of 16; this figure could not be corroborated against an updated AU official status list this cycle - [RFLD 2026 report, Malabo/Budapest/ECOWAS cybercrime treaties](https://rflgd.org/malabo-budapest-ecowas-cybercrime-treaties-women/) — Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection) — only 16 of 55 AU member states had ratified and deposited instruments as of the most recent AU status list, despite entering into force June 2023 - [NADPA-RAPDP Constitution (reviewed, 2022)](https://www.nadpa-rapdp.org/sites/default/files/2023-04/NADPA-RAPDP-Reviewed%20constitution-20220511.pdf) — NADPA-RAPDP — cooperation and capacity-building network for African DPAs established September 2016, not a legislative or enforcement body - [Malabo Convention, official treaty text](https://au.int/sites/default/files/treaties/29560-treaty-0048_-_african_union_convention_on_cyber_security_and_personal_data_protection_e.pdf) — NADPA/RAPDP — A cooperation and capacity-building network, not a legislative or enforcement body, governed by its 2022-reviewed Constitution, with 30+ member DPAs since September 2016 - [RFLD 2026 report, Malabo/Budapest/ECOWAS cybercrime treaties](https://rflgd.org/malabo-budapest-ecowas-cybercrime-treaties-women/) — Malabo Convention — Entered into force 8 June 2023, thirty days after Mauritania's ratification on 9 May 2023 became the 15th instrument of ratification under Article 36 - [African Union Infrastructure & Energy (official account)](https://x.com/au_ied/status/2082513718823305272) — African Union — 16 of 55 AU member states had ratified/deposited instruments of ratification to the Malabo Convention as at 8 July 2024, with 21 total signatures - [Streamlinefeed](https://streamlinefeed.co.ke/news/why-40-african-nations-delay-the-malabo-cyber-security-convention) — Kenya — Cabinet approved accession to the Malabo Convention in 2025, but as of September 2026 ratification still awaits National Assembly approval; Office of the Data Protection Commissioner opened stakeholder submissions - [Nigeria Data Protection Commission](https://ndpc.gov.ng/nigeria-leads-the-charge-ndpc-pushes-for-continent-wide-data-unification-at-nadpa-2026/) — NADPA/RAPDP is a cooperation and capacity-building network of African data protection authorities, not a legislative or enforcement body, and its existence is not evidence of binding continent-wide data-protection law. - [https://x.com/au_ied/status/2082513718823305272](https://x.com/au_ied/status/2082513718823305272) — African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) — No amendment or new accession to the Malabo Convention with a dated primary source was located within this cycle's window; the most recent dated event on record is Equatorial Guinea's signature (not ratification) on 28 July 2026, which predates this cycle's anchor. - [RFLD 2026 report, Malabo/Budapest/ECOWAS cybercrime treaties](https://rflgd.org/malabo-budapest-ecowas-cybercrime-treaties-women/) — Malabo Convention — 20 - [NADPA-RAPDP Constitution (reviewed, 2022)](https://www.nadpa-rapdp.org/sites/default/files/2023-04/NADPA-RAPDP-Reviewed%20constitution-20220511.pdf) — NADPA/RAPDP — is cooperation network not enforcement body: true - [Malabo Convention, official treaty text](https://au.int/sites/default/files/treaties/29560-treaty-0048_-_african_union_convention_on_cyber_security_and_personal_data_protection_e.pdf) — The Malabo Convention entered into force 8 June 2023 following Mauritania's ratification. - [NADPA-RAPDP Constitution (reviewed, 2022)](https://www.nadpa-rapdp.org/sites/default/files/2023-04/NADPA-RAPDP-Reviewed%20constitution-20220511.pdf) — NADPA/RAPDP is a cooperation and capacity-building network, not a legislative or enforcement authority. ### African bloc: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ No continental-level enumerated lawful-basis, consent, or special-category regime was found; only a general domestication mandate exists. Primary framework African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) Traffic-light rationale — Red No continental-level enumerated lawful-basis, consent, or special-category regime was found; only a general domestication mandate exists. D2 · Lawful Processing — Full Module Record 4 sub-modules · 75 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### African bloc: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ Absence of continental-level enumerated subject-rights text; rights exist only via national implementation. Primary framework African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) Traffic-light rationale — Red Absence of continental-level enumerated subject-rights text; rights exist only via national implementation. #### Sub-modules (5) #### Access RightRed No continental-level access-right text retrieved. Searched: Malabo Convention treaty text, Malabo Roadmap. Claims (1): - Continental-level materials reviewed (Malabo Convention treaty index, Malabo Roadmap, AU status list) do not evidence a harmonised continent-wide data-subject-rights framework; such rights, where they exist, are created by national implementing statutes rather than directly by the Malabo Convention. #### Rectification And ErasureRed No continental-level rectification/erasure text retrieved. #### Restriction And ObjectionRed No continental-level restriction/objection text retrieved. #### Data PortabilityRed No continental-level portability text retrieved. #### Deadlines And Response WindowsRed No continental-level statutory response-deadline text retrieved. No continental-level data-subject-rights framework (access, rectification, erasure, restriction, portability, deadlines) was evidenced in the Malabo Convention treaty index, status list, or Roadmap reviewed in this run. Such rights, where they exist, derive from national implementing statutes outside this JID's scope. Sources and claims (1) - [dataprotection.africa](https://dataprotection.africa/wp-content/uploads/malabo_roadmap_Sept_2022.pdf) — Continental-level materials reviewed (Malabo Convention treaty index, Malabo Roadmap, AU status list) do not evidence a harmonised continent-wide data-subject-rights framework; such rights, where they exist, are created by national implementing statutes rather than directly by the Malabo Convention. ### African bloc: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct sourced criticism confirms an enforcement/detail gap in the continental instrument; national-level duties fall outside this JID. Primary framework African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) Traffic-light rationale — Amber Direct sourced criticism confirms an enforcement/detail gap in the continental instrument; national-level duties fall outside this JID. D4 · Controller & Processor — Full Module Record 7 sub-modules · 57 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### African bloc: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A continental data-governance harmonisation instrument exists and is actively being operationalised, but no adequacy/SCC/BCR mechanism analogous to GDPR Chapter V exists at continental level. Primary framework AU Data Policy Framework (complementing the Malabo Convention) Traffic-light rationale — Amber A continental data-governance harmonisation instrument exists and is actively being operationalised, but no adequacy/SCC/BCR mechanism analogous to GDPR Chapter V exists at continental level. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 56 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### African bloc: D6 Sectoral Watch7 sub-modulesRedEnacted in forceModule confidence: Probable▾ No comprehensive continental sectoral overlay regime exists; this is a legitimate finding rather than a silent omission. Traffic-light rationale — Red No comprehensive continental sectoral overlay regime exists; this is a legitimate finding rather than a silent omission. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 69 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### African bloc: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No comprehensive continental adtech/commercial-privacy regime exists. Traffic-light rationale — Not assessed No comprehensive continental adtech/commercial-privacy regime exists. #### Sub-modules (6) #### Cookies And TrackersRed No continental cookie/tracker regime found. #### Dark PatternsRed No continental dark-pattern prohibition found. #### Opt Out SignalsRed No continental opt-out-signal standard found. #### Clean Rooms And DcrRed No continental clean-room/DCR rule found. #### Cross Context AdvertisingRed No continental cross-context advertising rule found. #### Direct MarketingRed No continental direct-marketing consent/suppression rule found. No continental-level cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal standard, clean-room rule, cross-context advertising rule, or direct-marketing consent standard was found in the Malabo Convention, AU status list, or Roadmap reviewed. Such rules, where present, exist only at the national level, outside this JID's continental treaty-status scope. Searched: Malabo Convention treaty text, Malabo Roadmap, AU Data Policy Framework materials — no continental adtech/commercial-privacy text found. ### African bloc: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A continental AI policy framework exists and is actively developing but is non-binding strategy, not enforceable data-protection law; biometric/genetic/surveillance carveouts remain unaddressed at continental level. Primary framework AU Continental Artificial Intelligence Strategy (non-binding) Traffic-light rationale — Amber A continental AI policy framework exists and is actively developing but is non-binding strategy, not enforceable data-protection law; biometric/genetic/surveillance carveouts remain unaddressed at continental level. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 71 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### African bloc: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No comprehensive continental children/vulnerable-groups regime exists; legitimate gap finding. Traffic-light rationale — Not assessed No comprehensive continental children/vulnerable-groups regime exists; legitimate gap finding. #### Sub-modules (5) #### Age VerificationRed No continental age-of-consent text found. #### Parental ConsentRed No continental parental-consent mechanism found. #### Minor Profiling BansRed No continental minor-profiling-ban found. #### Education SettingsRed No continental education-setting rule found. #### Dependent AdultsRed No continental dependent-adults protection found. No continental-level age-of-consent, parental-consent, minor-profiling-ban, education-setting, or dependent-adult provision was found in the Malabo Convention, AU status list, or Roadmap reviewed in this run. Such provisions, where they exist, are set at the national level. Searched: Malabo Convention treaty text, Malabo Roadmap, AU Data Policy Framework and Continental AI Strategy materials — no continental children/vulnerable-groups data-protection text found. ### African bloc: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Sourced criticism confirms an enforcement gap at the continental level, but recent (within-180-day) continental AI/data-governance activity signals ongoing institutional development. Primary framework African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) Traffic-light rationale — Amber Sourced criticism confirms an enforcement gap at the continental level, but recent (within-180-day) continental AI/data-governance activity signals ongoing institutional development. Periodic update · new data 2026-10-25 #### Enforcement & Redress The Malabo Convention provides no supranational enforcement or penalty mechanism of its own. Secondary commentary states that the Convention 'does not provide for mechanisms to support its enforcement,' meaning that compliance and redress for data-protection violations across African Union member states depends entirely on whatever enforcement apparatus exists at the national level, such as South Africa's Information Regulator under POPIA or Nigeria's Data Protection Commission under the NDPA, rather than on any continental body. This structural absence sits alongside the continuing uncertainty over how many member states have even ratified the Convention: the African Union's own confirmed figure stands at 16 of 55 states as at July 2024, with an unconfirmed secondary claim of 20 of 55 not corroborated. The combination of an unresolved ratification count and the absence of any enforcement mechanism at the continental level means that the practical weight of the Malabo Convention for redress purposes remains limited to whatever signalling effect ratification itself carries, rather than to any mechanism the Convention supplies directly. #### Outlook No development points toward a continental enforcement mechanism being added to the Malabo Convention; any change to this picture would require either a protocol amendment or a new African Union instrument, neither of which was reported as under consideration. The principal item to monitor remains whether the African Union publishes an updated ratification status list that resolves the 16-versus-20 discrepancy. Periodic update · new data 2026-10-11 #### Enforcement & Redress The Malabo Convention provides no supranational enforcement or penalty mechanism of its own. Secondary commentary states that the Convention 'does not provide for mechanisms to support its enforcement,' meaning that compliance and redress for data-protection violations across African Union member states depends entirely on whatever enforcement apparatus exists at the national level, such as South Africa's Information Regulator under POPIA or Nigeria's Data Protection Commission under the NDPA, rather than on any continental body. This structural absence sits alongside the continuing uncertainty over how many member states have even ratified the Convention: the African Union's own confirmed figure stands at 16 of 55 states as at July 2024, with an unconfirmed secondary claim of 20 of 55 not corroborated this cycle. The combination of an unresolved ratification count and the absence of any enforcement mechanism at the continental level means that the practical weight of the Malabo Convention for redress purposes remains limited to whatever signalling effect ratification itself carries, rather than to any mechanism the Convention supplies directly. #### Outlook No development this cycle points toward a continental enforcement mechanism being added to the Malabo Convention; any change to this picture would require either a protocol amendment or a new African Union instrument, neither of which was reported as under consideration this cycle. The principal item to monitor remains whether the African Union publishes an updated ratification status list that resolves the 16-versus-20 discrepancy. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 88 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties