Africa's data protection landscape isn't one regime — it's a growing patchwork of national laws, and the two most significant so far are South Africa's POPIA (in force since 2021) and Nigeria's Data Protection Act, 2023 (NDPA), which replaced an earlier, less formal regulation. A business operating across both markets needs to satisfy both independently.
Both created a dedicated regulator
South Africa's POPIA established the Information Regulator, a standalone body responsible for registration, guidance, complaints, and enforcement. Nigeria's NDPA did the same with the Nigeria Data Protection Commission (NDPC), which replaced the earlier Nigeria Data Protection Bureau and now holds the primary enforcement authority for data protection in Nigeria. Both models centralise enforcement in one national body, unlike the EU's distributed approach under GDPR.
Extraterritorial reach, in both directions
Neither law limits itself to companies physically based in the country. POPIA applies to processing carried out in South Africa, or by a responsible party domiciled there. The NDPA takes the same approach and explicitly extends to data controllers and processors not based in Nigeria if they process the personal data of people in Nigeria — closely mirroring the extraterritorial model GDPR popularised. A foreign SaaS company with Nigerian or South African users can be squarely in scope for either law without having any local office.
The compliance role: Information Officer vs Data Protection Officer
POPIA requires every responsible party to have an Information Officer — by default the most senior person in the organisation — registered with the Information Regulator, with no size threshold. The NDPA takes a more tiered approach closer to GDPR's model: it requires a Data Protection Officer specifically for "major" data controllers and processors — generally those handling personal data at significant scale or processing sensitive categories of data — rather than universally for every organisation regardless of size.
Registration and compliance audits
Under POPIA, only the Information Officer (not the organisation itself as a blanket rule) needs formal registration with the regulator. The NDPA introduces a more active compliance-audit expectation for larger data controllers and processors, requiring periodic data protection compliance audits to be filed with the NDPC — a more hands-on ongoing obligation than POPIA currently imposes in practice.
Penalties: both are tiered, but structured differently
POPIA's administrative fines cap at R10 million, with the possibility of criminal liability and imprisonment for certain offences. The NDPA introduces a tiered penalty structure that distinguishes between standard data controllers/processors and "major" ones (based on factors like the volume and sensitivity of data processed and the organisation's revenue), with materially higher penalty exposure for major data controllers and processors than for smaller ones. The exact figures and thresholds are set out in the Act and its regulations, so if a specific compliance decision hinges on the precise numbers, they're worth confirming directly against the current NDPC guidance rather than a secondary summary.
Cross-border data transfer restrictions
Both laws restrict sending personal data outside their borders unless adequate protection exists at the destination — POPIA requires the recipient be subject to a law, binding agreement, or rules providing comparable protection; the NDPA takes a similar adequacy-based approach, with the NDPC empowered to issue guidance on which jurisdictions or safeguard mechanisms qualify. Neither treats cross-border transfer as a formality that a standard cloud vendor contract automatically satisfies.
Practical takeaway for pan-African or international businesses
The overlap is substantial: a real data inventory, documented lawful bases for processing, genuine security safeguards, breach response procedures, and a properly appointed compliance role satisfy most of both regimes' foundations at once. Where they genuinely diverge — the DPO threshold under NDPA versus POPIA's universal Information Officer requirement, and the NDPA's more active compliance-audit filing expectation for larger organisations — needs to be handled per-jurisdiction rather than assumed to be covered by whichever regime you tackled first.
This guide is general information, not legal advice — specific obligations under either law depend on your processing activities, scale, and how each regulator's current guidance applies to your organisation. Consult a qualified professional for advice specific to your business.
Tracking both without duplicating the work
ComplianceDesk lets you activate the Nigeria Data Protection Act and POPIA as separate frameworks while sharing evidence across their overlapping controls — so a genuine data inventory, security policy, or vendor assessment can satisfy both frameworks at once instead of being built twice.