Authored By: Obakeng Tlapu
University of South Africa
Introduction
Currently, the issue of data localisation is very popular throughout Africa. Growing number of governments adopts the laws that mandate storing of all personal data on national servers, justified with self-determination narratives. Data localisation helps to boost cyber-defence, develops national IT industry and fights against what some call ‘data colonialism’[1]. This idea sounds good; however, after leaving aside the policy rhetoric, the picture becomes much more complicated. Usually, these laws lead to contrary effects compared to their goals,namely, these mandate harms human rights rather than protect them.
In this paper, I will examine how the trend of seeking data sovereignty affects privacy, freedom of speech, and trade in Africa. Through the analysis of the legal framework and court decisions in South Africa, Kenya and Nigeria, I will argue that mandating data storage within national borders without appropriate constitutional safeguards means a case of strengthened surveillance and weakened privacy protection. To solve this paradox, I suggest going beyond individual state data localisation laws towards harmonized regional one in which sovereignty and human rights are compatible with each other.
The Legal Framework: Sovereignty Claims and Human Rights Obligations
Basically, data localisation requires storage, processing and hosting of personal data only on national servers[2]. Most African governments included the data localisation mandates in the larger laws related to the protection of data, cybersecurity policy, or telecommunications licensing regulations. According to the Data Protection Regulation of 2019 in Nigeria, the transfer of personal data to another country is possible only in case it provides “adequate” protection of the data[3]. The Data Protection Act of 2019 in Kenya includes the same provisions[4]; and according to section 72 of the South African Protection of Personal Information Act (POPIA), the flow of personal data to foreign countries is possible only in certain cases[5].
As far as the motivations behind these laws, they are pretty much the same everywhere: to protect the citizens’ data from the foreign intelligence service, to encourage construction of local data centres, to provide additional technical jobs and to have the control over the national digital infrastructure[6]. However, the problem appears when considering the conflict between the aims of the sovereign states and the international obligations of them. According to article 17 of the International Covenant on Civil and Political Rights (ICCPR) that was ratified by most African states, there cannot be any arbitrary or unlawful interference with the privacy[7]. According to article 5 of the African Charter on Human and Peoples’ Rights, the same thing applies in Africa[8]. The African Commission’s 2019 Declaration of Principles on Freedom of Expression adds that the states should not impose data localisation requirements unless it can be proved to be absolutely necessary to preserve the international human rights standards[9].
Thus, there is a contradiction. The states have control over the data physically located in the national territory but ignore the obligation to protect the privacy, free speech and economic activities of the citizens. Without appropriate constitutional safeguards, the sovereignty wins over human rights.
The Human Rights Costs: Surveillance, Privacy and Economic Rights
Of course, privacy comes first. The local storage makes it easier for domestic agencies to access the data without much judicial authorization. For example, in Nigeria, the local storage mandate works together with the interception powers granted by the Cybercrimes Act 2015 that gives great opportunities for monitoring the private communications[10]. Kenya is also facing the same situation: the National Intelligence Service Act 2012 grants the security agencies vast powers to demand personal data and thus causes an arbitrary interference with the privacy[11].
None of the African courts made the decision about the constitutionality of the data localisation mandates but the latest jurisprudence proves that data protection is a fundamental right. Namely, in Incorporated Trustees of Digital Rights Lawyers Initiative v NIMC case, the Court of Appeal in Nigeria decided that the right to privacy guaranteed by section 37 of the Constitution is also the right to the data privacy[12]. Also, in Nubian Rights Forum v Attorney General case in Kenya, the High Court declared as unconstitutional the mandatory collection of the DNA and GPS data as the unconstitutional breach of the constitutional right to privacy[13]. These court decisions show that the judiciary can put the check on the data governance regime to prevent it from making the surveillance more widespread.
It becomes even more important because the uncontrolled surveillance always has the negative influence on the public life. People tend to censor themselves knowing that their private messages, search history and other personal data can be accessed by the government[14]. This problem is quite serious,for example, the 2022 research shows that the violation of the right to digital privacy in almost 86% of the cases in African jurisdictions remained unpunished because of poor enforcement and tendency of telecom operators to satisfy the requests of the government[15].
However, economic problems of data localisation become even more serious than those concerning the privacy. Because of strict data residency requirements, the fragmentation of the African digital economy happens; it is impossible to use the tools of e-commerce, cloud computing and trade that require cross-border data flows[16]. Companies need to spend money to duplicate their infrastructure and individuals loose the access to the global services that affect the socio-economic rights, such as the right to trade and to benefit from the scientific progress[17]. The data transfer restriction in South Africa faced the criticism due to discouragement of foreign tech investments and slow local innovation[18].
A Path Forward: Regional Harmonization and Safeguards
I do not suggest giving up on digital sovereignty which is neither realistic nor desirable. However, I suggest reconsidering this concept. Instead of individual data borders, the states should adopt the regional data governance framework based on the principles of the African Union’s Digital Transformation Strategy and AfCFTA Protocol on Digital Trade[19].
Firstly, it is the adequate system of the cross-border data flows similar to that of the GDPR in EU[20]. It will allow transferring the data only to the countries with certain privacy standards and will maintain the regional digital connectivity without loss of the regulation.
Secondly, it is the embedding of the constitutional safeguards in the national privacy laws – namely, obtaining the authorization from the court before accessing the personal data, transparency reports about the surveillance activities from the security agencies and independent data protection agencies with the enforcement power[21].
Thirdly, instead of making things individually, it makes sense to unite the efforts to create the shared regional cloud infrastructure and data hubs and thus avoid the dependence on the big foreign technology companies and have access to the internet[22].
Conclusion
The trend of data localisation in Africa is motivated by the desire for digital sovereignty in the market that traditionally was dominated by a few multinational technology companies. However, lacking the constitutional safeguards, these policies cause the harms to the very people that they were designed to protect,increased surveillance, self-censorship and the fragmentation of the regional economy. The price is very high for the control that, itself, does not mean the sovereignty.
The true digital sovereignty is not about restricting human rights; it is about regional cooperation and human rights-based legislation that will allow data flows while protecting individuals whose data it is.
Bibliography
Table of Cases and Administrative Declarations
- African Commission on Human and Peoples’ Rights, Declaration of Principles on Freedom of Expression and Access to Information in Africa (2019)
- Incorporated Trustees of Digital Rights Lawyers Initiative v National Identity Management Commission (NIMC) (2021) CA/IB/291/2020 (Court of Appeal, Nigeria)
- Nubian Rights Forum and Others v The Hon. Attorney General and Others [2020] eKLR, Consolidated Petitions No 56, 58 & 109 of 2019 (High Court of Kenya)
Legislation & Statutory Material
Domestic Legislation
- Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (Nigeria)
- Data Protection Act 2019 (Kenya, Act No 24 of 2019)
- National Intelligence Service Act 2012 (Kenya, Act No 28 of 2012)
- Nigeria Data Protection Regulation 2019
- Protection of Personal Information Act 4 of 2013 (South Africa)
International and Regional Instruments
- African Charter on Human and Peoples’ Rights (adopted 27 June 1981, entered into force 21 October 1986) OAU Doc CAB/LEG/67/3 rev 5
- African Continental Free Trade Area, Protocol on Digital Trade (2023)
- African Union, Digital Transformation Strategy for Africa (2020–2030) (2020)
- International Covenant on Civil and Political Rights (adopted 16 December 1966, entered into force 23 March 1976) 999 UNTS 171
- International Covenant on Economic, Social and Cultural Rights (adopted 16 December 1966, entered into force 3 January 1976) 993 UNTS 3
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1
Secondary Sources
Reports, Policy Papers, and Institutional Publications
- Center for Global Development, Data Localization: A Tax on the Poor (2024)
- CIPESA, Which Way for Data Localisation in Africa? (Policy Brief, June 2024)
- FES Geneva, Digital Trade in Africa (2025)
- Mandela Institute for Human Rights, Exploring Policy Trade-Offs for Data Localisation in South Africa, Kenya and Nigeria (Policy Brief No 185, June 2024)
Articles and Online Sources
- Lirri E, ‘Privacy Imperilled: Analysis of Surveillance, Encryption and Data Localisation Laws in Africa’ (CIPESA, 16 August 2022) https://cipesa.org accessed 3 August 2026
[1] CIPESA, Which Way for Data Localisation in Africa? (Policy Brief, June 2024) 3.
[2] Mandela Institute for Human Rights, Exploring Policy Trade-Offs for Data Localisation in South Africa, Kenya and Nigeria (Policy Brief No 185, June 2024) 5.
[3] Nigeria Data Protection Regulation 2019, reg 2.1.
[4] Data Protection Act 2019 (Kenya, Act No 24 of 2019) s 48.
[5] Protection of Personal Information Act 4 of 2013 (South Africa) s 72.
[6] FES Geneva, Digital Trade in Africa (2025) 12.
[7] International Covenant on Civil and Political Rights (adopted 16 December 1966, entered into force 23 March 1976) 999 UNTS 171, art 17.
[8] African Charter on Human and Peoples’ Rights (adopted 27 June 1981, entered into force 21 October 1986) OAU Doc CAB/LEG/67/3 rev 5, art 6.
[9] African Commission on Human and Peoples’ Rights, Declaration of Principles on Freedom of Expression and Access to Information in Africa (2019) principle 45.
[10] Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (Nigeria) s 28.
[11] National Intelligence Service Act 2012 (Kenya, Act No 28 of 2012) s 19.
[12] Incorporated Trustees of Digital Rights Lawyers Initiative v National Identity Management Commission (NIMC) (2021) CA/IB/291/2020 (Court of Appeal, Nigeria).
[13] Nubian Rights Forum and Others v The Hon. Attorney General and Others [2020] eKLR, Consolidated Petitions No 56, 58 & 109 of 2019 (High Court of Kenya).
[14] Evelyn Lirri, ‘Privacy Imperilled: Analysis of Surveillance, Encryption and Data Localisation Laws in Africa’ (CIPESA, 16 August 2022) 8.
[15] ibid 12.
[16] Center for Global Development, Data Localization: A Tax on the Poor (2024) 4.
[17] nternational Covenant on Economic, Social and Cultural Rights (adopted 16 December 1966, entered into force 3 January 1976) 993 UNTS 3, arts 6, 15.
[18] Mandela Institute (n 2) 9.
[19] African Union, Digital Transformation Strategy for Africa (2020–2030) (2020); African Continental Free Trade Area, Protocol on Digital Trade (2023).
[20] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1, arts 45–46.
[21] CIPESA (n 1) 15.
[22] FES Geneva (n 6) 18.
