Data protection regulators in East Africa have moved from awareness-raising to enforcement. Penalty notices, compliance audits and registration drives have become routine, and boards are asking whether their organisations are ready.
Where regulators are looking
Recent enforcement has focused on direct marketing without consent, inadequate responses to data subject requests, and cross-border transfers made without appropriate safeguards.
Five practical steps
Confirm registration status in each market. Map high-risk processing and complete impact assessments. Review transfer mechanisms for cloud and group-wide systems. Test your breach response plan. Brief the board at least once a year.
None of these steps is new. What is new is the cost of not taking them.
This publication is for general information only and does not constitute legal advice. Igweta Advocates is a fictional firm presented for demonstration.