Navigating the Crossroads: The Challenges of Cross-Border Data Flows under Domestic Laws in Africa

The seamless flow of data across borders, a cornerstone of the digital age, faces significant hurdles due to inconsistencies between domestic data protection laws in various African countries.¹ This blog explores how the requirements set out under domestic data protection laws may pose a challenge to the realization of cross-border data flows in Africa. Some of the challenges that will be analyzed is the effect of opt-in consent obligations and data localization requirements. While these requirements are often driven by concerns over data sovereignty and security, they can act as barriers to cross-border data flows, hindering the growth of digital services and innovation.²

Highlighting Contradictions between Domestic Laws

While there are 55 African countries, 35 of them have data protection laws and 3 have draft laws.³ Most of the data protection laws contain provisions on cross-border data flows.⁴ These provisions typically require data controllers to obtain the consent of individuals before transferring their personal data to a foreign country.⁵ Additionally, some laws require data controllers to transfer personal data only to countries that have been deemed to have adequate data protection safeguards.⁶

While these data protection laws are generally supportive of cross-border data flows, there are some instances where they may create challenges for businesses.⁷ For example, data localization requirements, which mandate that certain types of data be stored and processed within a country’s borders, can make it difficult for companies to operate across multiple jurisdictions. Additionally, conflicting data protection standards and varying interpretations of data privacy principles can lead to confusion and compliance difficulties.⁸ The subsequent section will entail examining the provisions of data protection frameworks for 6 African countries and their impact on cross-border data flows.

Explicit Opt-in Consent Requirement

i. Kenya

Part VI of The Kenya Data Protection Act provides for the transfer of personal data outside Kenya.⁹ The data controller or data processor may transfer personal data outside Kenya subject to giving proof to the Data Commissioner that appropriate safeguards have been taken to protect and secure personal data.¹⁰ The Data Protection (General) Regulations, 2021 outlines principles for the transfer of personal data outside the country.¹¹ In addition, it necessitates that personal data can only be transferred outside Kenya on the basis of appropriate safeguards, adequacy decision, necessity, and consent.¹² Prior to transferring personal data, an agreement may be executed between the transferring entity and the recipient of the personal data.¹³

Kenya’s Data Protection Act (DPA) requires explicit opt-in consent for certain types of data processing before data can be transferred to a foreign country.¹⁴ This means that individuals must actively give their consent to the transfer of their data, rather than simply opting out of having their data transferred.¹⁵ An “explicit opt-in consent” is “a clear and unambiguous statement or act which signifies the individual’s agreement to the processing of their personal data for a specific purpose.” This consent must be freely given, informed, and specific.

In practice, these data protection consent requirements means that Kenyan companies may need to obtain explicit opt-in consent from its customers before transferring their data to a foreign country, such as for the purpose of cloud storage or data processing. The strict approach adopted by Kenya’s Data Protection Act on data processing consent, can create compliance difficulties for companies operating across multiple jurisdictions.¹⁶

Data Localization Requirement

ii. Nigeria

Nigeria’s Data Protection Act has a data localization requirement, thus, the personal data of Nigerian citizens must be stored within Nigeria.¹⁷ The Act defines personal data as “any information relating to an individual who can be identified or is identifiable by reference to an identifier such as name, address, contact information, and financial information.¹⁸

The data localization requirement applies to all data controllers and processors that process personal data of Nigerian citizens.¹⁹ Section 41 of the Nigeria Data Protection Act 2023 restricts cross-border personal data transfer unless the recipient is governed by a law that protects personal data and subject to the consent of the data subject.²⁰ The data can also only be transferred on the basis of necessity, public interest, sole benefit of the data owner and in order to protect certain vital interests of the data subject.²¹ Any basis of transfer of personal data is recorded by the data controller or processor.

The Act emphasizes that personal data ought to be transferred to jurisdictions that afford adequate levels of protection to data subjects.²² Adequacy of protection is assessed based on the availability of enforceability mechanisms, the agreement between the Commission and the receiving jurisdiction, ability of data subjects to access a public authority, presence of effective data protection law, existence of independent supervisory authority and international commitments binding on the respective country.²³

These obligations outlined under Nigeria’s Data protection law, although enacted with the goal of protecting the personal data of Nigerian citizens, pose a challenge for companies operating across multiple African markets.²⁴ They can lead to higher operating costs and make it difficult to do business in Nigeria. For example, a multinational e-commerce company operating in Nigeria and Ghana may face difficulties in complying with both countries’ data localization requirements, as data stored in Nigeria cannot be freely transferred to Ghana and vice versa.

iii. Zambia

In 2021, Zambia passed its Data Protection Act. Part X of the Act, regulates transfer of personal data across borders.²⁵ Section 70 (1) and (3) obligates a data controller to process and store personal and sensitive personal data on a data centre or server within Zambia.²⁶ These sections mandate that data controllers process and store personal data and sensitive personal data on a server or data center located within Zambia. This means that organizations are not allowed to store personal data or sensitive personal data of Zambian citizens or residents outside of Zambia.²⁷ This provision is designed to protect the privacy and security of personal data by keeping it within the country. It also aims to promote the development of the local data center industry and create jobs in Zambia.²⁸

Furthermore. Section 70 (2) allows the Minister of Transport, Works, Supply and Communications to prescribe the categories of personal data that can be stored outside Zambia.²⁹ Personal data categorized under this section can be transferred outside the Republic if they meet the following requirements: One, if the data subject has consented to the transfer. Two, if the transfer is made in accordance with intragroup schemes and standard contracts approved by the Office of the Data Protection Commissioner. Three, if the Minister has prescribed that the transborder transfers are permissible. Fourth, if the Office of the Data Protection Commissioner approves a particular transfer or a set of transfers due to a situation of necessity.

Zambia’s Data Protection Act can be a significant restriction on organizations that operate in Zambia. This restriction can make it difficult for organizations to innovate and manage their data effectively. For example, A Zambian e-commerce company that collects personal data from its Zambian customers may need to invest in building or renting data centers in Zambia if it wants to store all of its customers’ personal data within the country.

iv. Botswana

Section 48 (1) of the Botswana Data Protection Act, 2018 bars the transfer of data from Botswana to another country.³⁰ This means that as a general rule, organizations are not allowed to send personal data of Botswana citizens or residents outside of Botswana. However, there are a few exceptions to this general rule, Section 48 (2) allows the Minister of State President to outline a list of countries where transfer of personal data is permitted. This means that the Minister has the power to designate certain countries as “adequate” for data protection purposes, which would allow organizations to transfer personal data to those countries without obtaining additional consent from individuals.³¹

In 2022, the Minister of State President published a Transfer of Personal Data Order, which declares that personal data may be transferred from Botswana to 45 countries.³² South Africa and Kenya are the only African countries on the list. The list includes other countries such as the Republic of Korea, United Kingdom, New Zealand, Japan, Isle of Man, Switzerland, Uruguay and Argentina.³³

The general prohibition on the transfer of personal data from Botswana to other countries is a significant restriction on organizations that operate in Botswana. This restriction can make it difficult for organizations to comply with their contractual obligations, to manage their data effectively, and to innovate. The Minister’s power to designate certain countries as “adequate” for data protection purposes can also be a source of uncertainty for organizations. This is because the Minister’s criteria for determining adequacy may not be clear or transparent.

Countries that have Adequate Legal Protection Requirement

v. South Africa

Data protection in South Africa is governed by the Protection of Personal Information Act, 2013 (POPIA).³⁴ POPIA safeguards the constitutional right to privacy by protecting personal information that is processed by a “responsible party,” while at the same time maintaining the right to access information. The Act regulates the circumstances where a responsible party in South Africa transfers personal information about a data subject to a third party. Section 72 of the POPIA outlines the requirements for cross-border transfer of data; it ensures the data subject enjoys sufficient legal protection.³⁵ It ensures that the data subject enjoys sufficient legal protection. This means that organizations must take steps to protect the privacy and security of personal information when it is transferred to a foreign country.

Section 72 (1) provides that a responsible party may only transfer personal information to a third party which is a foreign country if it meets certain requirements.³⁶ The requirements include: first, adequate legal protection, the cross-border recipient must be subject to law or a contract to ensure sufficient legal protection. Second, the data subject must consent to the transfer of personal information. Third, the transfer of personal information is necessary for the performance of a contract between the responsible party and the data subject. Fourth, the transfer of personal data is essential in meeting the interests of the data subject. Fifth, the transfer of personal data must benefit the data subject.

While the requirements of Section 72(1) are aimed at increasing privacy protection and enhanced data security, they can have a number of implications for organizations that operate in South Africa. These implications include: First, increased costs as organizations may need to invest in new technologies and infrastructure to comply with the requirements of Section 72.³⁷ Second, organizations may face reduced efficiency as it may be difficult to manage their data if they are scattered across multiple data centers in different countries. Consequently, they make it more difficult to attain cross-border data flows.

vi. Eswatini

In 2022, Mswati III, King of the Kingdom of Eswatini passed the Data Protection Act to regulate processing, disclosure and protecting personal data while balancing competing values of personal information privacy.³⁸ Part V of the Act provides for trans-border flow of personal information outside Eswatini. Section 32 covers transfer of personal information within SADC Member States. It provides that transfer to recipients in a Member State can only happen to a country that has transposed the SADC data protection requirements.³⁹ Furthermore, the recipient must establish that the data is necessary for the performance of the task and the legitimate interests of the data subjects is protected. Section 33 regulates the transfer of personal information to non-SADC Member States. It outlines that transfer of personal data can only be affected to such countries if they meet the adequate level of protection depending on the circumstances surrounding the data transfer.⁴⁰

Eswatini Data Protection law makes it even more difficult to implement cross-border transfer as it categorizes countries into SADC and non-SADC members, essentially adding another layer of obligations for non-SADC members to meet before effecting cross-border transfer of data across Africa.⁴¹ For instance, a fintech company seeking to transfer customer data from Eswatini to Kenya may encounter delays and administrative hurdles due to the lack of a harmonized data transfer mechanism between the two countries.

Although the requirements of Section 32 and 33 are a significant step forward in protecting the privacy of personal information in Eswatini, they can result in increased costs and compliance challenges for organizations in Eswatini that need to ensure that their data transfer practices comply with data protection laws and regulations.⁴²

The Effect of Conflicting Data Protection Standards on Cross Border Transfer of Data

The patchwork of data protection laws across African countries creates a complex regulatory landscape for businesses operating in the digital realm.⁴³ Varying levels of data protection standards and differing interpretations of data privacy principles can lead to confusion and compliance challenges.⁴⁴ The mechanisms for transferring data across borders also vary significantly among African countries. While some countries have adopted adequacy frameworks, which recognize jurisdictions with equivalent data protection standards, others rely on contractual arrangements or specific authorizations for data transfers.⁴⁵

Conflicting data protection standards can have a number of negative effects on businesses, individuals, and the economy as a whole. These effects include: One, increased costs as businesses may need to invest in new technologies and infrastructure to comply with multiple and conflicting data protection standards.⁴⁶ Two, reduced efficiency due to the need to comply with multiple and conflicting data protection standards can be a complex and time-consuming process.⁴⁷ Three, legal uncertainty caused by conflicting data protection standards can create legal ambiguity for businesses.⁴⁸ Four, conflicting data protection standards can stifle innovation. Businesses may be reluctant to develop new products or services if they are uncertain about whether they will comply with all applicable data protection laws.⁴⁹

Five, conflicting data protection standards can fragment the global digital economy. This can make it more difficult for businesses to operate internationally and can lead to higher costs for consumers.⁵⁰ For instance, a company seeking to transfer data from Kenya to South Africa may need to navigate different legal requirements and obtain separate authorizations, adding to the complexity and cost of doing business. Due to conflicting standards, a cloud service provider operating across multiple African countries may struggle to meet the varying data protection standards, such as different consent requirements or data retention periods, leading to potential compliance risks.⁵¹

Conclusion: Harmonization as the Way Forward

In this blog, we pinpointed a number of domestic data protection laws in Africa and highlighted the implications of their provisions on cross-border data transfers. Data protection laws in Africa are becoming increasingly complex and stringent, with the aim of safeguarding the privacy of individuals while enabling the flow of data across borders. However, these laws can also pose challenges for cross-border transfer data for businesses operating in the region, particularly due to opt-in consent and data localization requirements. Opt-in consent requirements can be difficult to obtain on a large scale, and data localization obligations can increase costs and reduce efficiency. Harmonizing data protection standards and developing clear data transfer mechanisms across the continent can help mitigate these challenges and facilitate a more seamless flow of data within Africa.

Image by WangXiNa on Freepik