The report provides a comprehensive overview of the rapidly evolving data protection landscape across the Middle East and Africa (MEA) region. In recent years, the number of African countries with dedicated data protection legislation has doubled, rising from twenty-four in early 2019 to forty-nine in August 2026. This expansion has been influenced by regional instruments such as the African Union Malabo Convention and the ECOWAS Supplementary Act on Personal Data Protection, as well as international standards.
Among the key topics covered:
- New laws: Several countries — including Botswana, Burundi, Cameroon, the Central African Republic, Djibouti, Ethiopia, Malawi, Syria and The Gambia — have enacted their first dedicated data protection statutes or have substantially overhauled their existing frameworks.
- Amendments: Algeria and the Dubai International Financial Centre (DIFC) have introduced significant amendments to their data protection frameworks, strengthening DPO regimes, record-keeping obligations and enforcement mechanisms.
- Regulations: New implementing regulations have been issued in jurisdictions including Egypt, Jordan, Mauritius, Saudi Arabia, South Africa and Zimbabwe, providing organisations with more detailed compliance frameworks.
- Guidance documents: A broad range of practical guidance has been published by data protection authorities across the region covering topics such as DPO requirements, breach notification, data subject consent, cross-border transfers and AI.
Looking ahead, the report notes that further legislative developments are expected in Sierra Leone, South Sudan and Namibia, while countries such as Senegal, Ghana, Gabon, Côte d’Ivoire and Guinea are working to strengthen or replace their current frameworks. The report also highlights an emerging trend in Francophone Africa toward comprehensive digital codes covering telecommunications, electronic transactions, cybersecurity, cybercrime and data protection within a single enactment.
As Aïssatou Sylla notes, organisations operating across multiple MEA jurisdictions should anticipate increasing complexity in their regional and global compliance programmes. Areas such as AI and automated decision-making, children’s data, biometrics, workplace surveillance, health information, location tracking and digital marketing are likely to attract growing regulatory attention.
Read the full report here.
About the Author
Aïssatou Sylla is a Partner at Asafo & Co. in Paris, specialising in privacy, technology and intellectual property law. Her practice focuses on digital, data protection, cybersecurity, artificial intelligence, copyright, media/entertainment, cloud contracts and complex IT projects. She also leads the firm’s work on Africa’s digital transformation, advising companies investing in Africa on their compliance efforts and working with African governments and data protection authorities on policy making and regulatory matters.