Does GDPR Apply to African Startups? A Data Privacy Guide

GDPR applies to an African startup that offers goods or services to people in the EU or monitors their behaviour there, wherever the company is based. At home, Kenya's Data Protection Act 2019, Nigeria's Data Protection Act 2023 and South Africa's POPIA set similar rules. One privacy programme, built carefully, can meet most of all four.

I co-founded Hackhouse, a builders' hub in Nairobi. This guide covers when each law reaches you, what Kenya, Nigeria and South Africa require, and a 90-day plan for a small team. It is general information, so take legal advice on your own situation.

When does GDPR apply to a company outside Europe?

Article 3(2) of the GDPR says it applies to controllers and processors not established in the EU when they process personal data of people in the EU and the processing relates to either "the offering of goods or services" to them, paid or free, or "the monitoring of their behaviour" in the EU (GDPR Article 3).

For example, a Kenyan SaaS company that markets to and signs up customers in Germany is likely in scope. So is an app that tracks the behaviour of users while they are in France. A Nairobi shop whose website happens to get a few visits from Europe, without targeting them, is a weaker case.

The top tier of GDPR fines is up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (GDPR Article 83). For most startups, the nearer risk is commercial: enterprise buyers often send a data protection questionnaire before they sign, and you need clear answers.

What does Kenya's Data Protection Act require?

The Data Protection Act 2019 is enforced by the Office of the Data Protection Commissioner (ODPC). Key points, as summarised by DLA Piper:

• Registration. Controllers and processors must register unless their annual turnover is below KES 5 million and they have fewer than 10 employees. Some sectors must register whatever their size, including education, health, financial services, telecommunications, direct marketing, transport and ride-hailing, and digital credit.
• Certificate. Registration lasts 24 months, so diarise the renewal.
• Breaches. Controllers must notify the Data Commissioner within 72 hours of becoming aware of a breach that poses what the Act calls a "real risk of harm". Processors must tell the controller within 48 hours.
• Penalties. Penalty notices can reach KES 5 million or 1% of the previous year's turnover, whichever is lower.
• Transfers abroad. You need appropriate safeguards or another legal basis to send personal data outside Kenya, and consent to transfer sensitive personal data.

What do Nigeria and South Africa require?

Nigeria

Nigeria's Data Protection Act 2023 is enforced by the Nigeria Data Protection Commission (NDPC). Its General Application and Implementation Directive (GAID) was issued on 20 March 2025 and took effect on 19 September 2025 (DLA Piper, June 2025). Obligations include registering with the NDPC if you are a data controller or processor of major importance, a compliance audit within 15 months of starting operations and then every year, appointing a data protection officer, and impact assessments where required.

South Africa

The Protection of Personal Information Act (POPIA) is enforced by the Information Regulator. Information officers must be registered with the Regulator. After a breach, you must notify the Regulator and affected people as soon as reasonably possible, and the maximum administrative fine is R10 million (DLA Piper).

What is changing across Africa?

The African Union's Malabo Convention on cyber security and personal data protection entered into force on 8 June 2023, after Mauritania became the 15th country to ratify it (EU Cyber Direct). Kenya's rules list ratification of the Convention among the safeguards for transfers abroad.

Kenya and the EU launched the first adequacy dialogue on the African continent in May 2024 (EU Delegation to Kenya). An adequacy decision would let personal data flow from the EU to Kenya without extra transfer tools. We found no adopted decision as of 5 November 2026, so plan on using standard contractual safeguards for now.

What should a startup do in its first 90 days?

1. Map your data. List each type of personal data you collect, where it is stored, who can see it and why you need it. Delete what you cannot justify.
2. Pick a lawful basis for each use. Where you rely on consent, ask in plain words, separately for separate purposes, with no pre-ticked boxes, and make withdrawal easy.
3. Publish a privacy notice people can read. Say what you collect, why, who you share it with and how people can access, correct or delete their data.
4. Sign data processing agreements with every vendor that handles your users' data, from hosting to email and analytics.
5. Register where required. Check the ODPC thresholds and sector list in Kenya, the NDPC rules in Nigeria, and information officer registration in South Africa.
6. Plan for a breach. Write down who investigates, who decides, and who notifies the regulator and users. Kenya gives controllers 72 hours.
7. Secure the basics. Access controls, two-factor sign-in and encryption protect the data your policies describe. Our cybersecurity basics guide covers them.

If you want to compare notes with founders working through the same rules, join our communities or come to a Hackhouse event.

Key facts

• GDPR Article 3(2) covers non-EU companies that offer goods or services to, or monitor, people in the EU.
• Top-tier GDPR fines reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher.
• Kenya exempts controllers and processors below KES 5 million turnover with fewer than 10 employees, except in listed sectors.
• Kenyan controllers must report qualifying breaches within 72 hours.
• Nigeria's GAID took effect on 19 September 2025.
• POPIA administrative fines reach R10 million.

Frequently asked questions

Does GDPR apply if my servers are in Africa?

Yes, if you offer goods or services to people in the EU or monitor their behaviour there. Server location does not change the Article 3(2) test.

Do I need to register with Kenya's Data Commissioner?

Yes, unless your turnover is below KES 5 million and you have fewer than 10 employees. Some sectors, such as health, education, financial services and digital credit, must register regardless of size.

How fast must I report a data breach in Kenya?

Within 72 hours of becoming aware of a breach that poses what the Act calls a "real risk of harm". If you are late, explain the delay in the notice.

Is one privacy programme enough for several countries?

It covers most of the work, because the laws share core principles. You still need to meet each country's registration, breach and transfer rules.

Sources

• Art. 3 GDPR: Territorial scope, GDPR text, checked 5 Nov 2026
• Art. 83 GDPR: General conditions for imposing administrative fines, GDPR text, checked 5 Nov 2026
• Data protection laws of the world: Kenya, DLA Piper, checked 5 Nov 2026
• Data protection laws of the world: South Africa, DLA Piper, checked 5 Nov 2026
• Nigeria: NDPC issues GAID, key compliance insights, DLA Piper, checked 5 Nov 2026
• Africa's cybersecurity treaty enters into force, EU Cyber Direct, checked 5 Nov 2026
• Kenya and the EU launch very first Adequacy Dialogue on the African continent, EU Delegation to Kenya, checked 5 Nov 2026

Go deeper with us. Join the Hackhouse community for conversations that go beyond the surface, where builders share the hard-won lessons that never make it into press releases.