Every VASP operating in Kenya must comply with the VASP Act 2025 by 4 November 2026. The implementing regulations that define what compliance means have not been gazetted. That combination is the compliance story of the Kenyan crypto year.
Read more →The UK ICO published guidance on AI-generated freedom of information requests in May 2026. African DPAs cite ICO precedent habitually, and Nigeria's NDPC has already signed a 60-authority statement on AI imagery. Public bodies should read this as a preview.
Read more →Two 2026 decisions close the gap between an ODPC determination and real consequences: criminal exposure for directors, and High Court execution machinery for compensation awards.
Read more →The ODPC opened a suo moto investigation into Ray-Ban Meta smart glasses after reporting revealed footage from the devices was being reviewed by human contractors in Nairobi to train Meta's AI. After Worldcoin, the direction is unmistakable.
Read more →The central bank for eight West African states surveyed fintechs on crypto in February, then convened an international crypto-assets conference in Dakar in May. When the BCEAO finally regulates, one framework lands in eight countries on the same day.
Read more →Investigations into Temu and the Corporate Affairs Commission, a security advisory with mandatory upgrades, MoUs reaching procurement and all 36 states: the NDPC's 2026 is a build-out of enforcement infrastructure, not a run of one-off cases.
Read more →The Pharmacy and Poisons Board now regulates software as a medical device: a four-category IMDRF risk matrix, registration through the Board's portal, cybersecurity documentation, and ten Good Machine Learning Practice principles for AI. Health apps that diagnose or treat sit in the highest categories, and the guideline orders compliance with the Data Protection Act 2019 and the Digital Health Act 2023 by name.
Read more →The ODPC's own statistics, announced at the January 2026 Annual Data Privacy Conference, describe the most active enforcement docket on the continent. The pattern in the data tells you who gets investigated.
Read more →Fourteen years after Act 843, Ghana's DPC has moved from awareness campaigns to nationwide enforcement, with a new Data Protection Bill queued behind it. Registration is the exposed flank.
Read more →Ghana's VASP Act (Act 1154) took Africa's standalone crypto statutes to three inside a quarter, and its SEC sandbox admitted its first participant within four months of assent. The anglophone West African licensing model is converging fast.
Read more →Proclamation 1321/2024 carries 4%-of-turnover penalties and prison terms, yet two years in there are no implementing directives, no registration portal and no enforcement. Meanwhile the National Bank banned birr-paired crypto P2P in one statement.
Read more →What POPIA means is being decided in litigation the Regulator keeps initiating: matric results, telemarketing, WhatsApp, and a contested R5 million fine. The scoreboard so far favours respondents.
Read more →South Africa exited the FATF grey list in October 2025. What followed was not relaxation but codification: draft Capital Flow Management Regulations that classify crypto as 'capital', CARF reporting from March 2026, and 30 FSCA inspections in a year.
Read more →The NDPA 2023 sets the principles. The General Application and Implementation Directive is where Nigerian compliance obligations actually live. If your programme was built on the NITDA-era regulation, it is out of date.
Read more →Uganda's data protection authority held that a company with no Ugandan office, staff or servers is still a regulated data controller. The reasoning travels.
Read more →Iris scans in exchange for about $50 in tokens, no DPIA. The High Court's Worldcoin ruling is the reference point for every biometric processing question in Kenya, and no appeal has been filed.
Read more →No analyses match. Clear the search or pick another filter.