Law: Supplementary Act A/SA. 1/01/10 on Personal Data Protection within ECOWAS (the Act), in relation to the Economic Community of West African States (ECOWAS).

The African Union Convention on Cyber Security and Personal Data Protection (the Convention), in relation to the African Union (AU).

Regulator: There is no general personal data protection regulator applicable across African Bodies, although both the Act and the Convention provide for the establishment of a data protection authority.

Summary: The Economic Community of West African States (ECOWAS) is a 15-member regional group aimed at promoting economic integration in several fields of activity among the constituent countries. In 2010, ECOWAS adopted the Supplementary Act A/SA. 1/01/10 on Personal Data Protection within ECOWAS (the Act), with the purpose of tackling personal data protection and encouraging Member States to adopt harmonized data protection regulatory frameworks, which mirrored, to a degree, the Data Protection Directive (Directive 95/46/EC). The Act further outlines the basic principles and data subject rights that guide the processing of personal data and establishes consent as the primary legal basis.

Separately, the African Union is a continental body consisting of 55 Member States corresponding to the countries of the African continent and was established with the purpose of enhancing political and socio-economic integration. The African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention) entered into effect in June 2023 and set forth a normative framework including rules establishing that Member States must commit themselves to the creation of a legal framework protecting personal data, and at the same time, enable the free flow of information.