ODPC opened suo moto investigation into Ray-Ban Meta smart glasses after direct appeal March 6, 2026. Cameras capable of continuous recording without subject knowledge. Signals proactive ODPC enforcement posture -- not waiting for complaints.
Commercial Implication
Any company selling wearables with embedded recording or biometric capability in Kenya now faces heightened ODPC scrutiny. Privacy-by-design requirements apply.
biometricsprivacyconsumer-protection
2026-04-051d
🇳🇬 NG
NDPC Serves Notice of Investigation Following Cybersecurity BreachNDPA 2023 breach notification, FG coordination
NDPC served Notice of Investigation April 1, 2026 following cybersecurity breach. FG coordinating breach response between cybersecurity and NDPA 2023 mandates. LinkedIn draft prepared (v4).
Commercial Implication
Breach notification is not optional. The gap between incident response and regulatory disclosure is where liability is created. NDPC-ready breach protocols essential.
breach-responseNDPA-2023
2026-04-042d
🇰🇪 KE
Kenya Draft VASP Regulations 2026 Open for ConsultationVASP Act 2025 implementing regs, FATF Travel Rule
National Treasury published Draft VASP Regulations 2026. First implementing regulation under VASP Act 2025. FATF Recommendation 15 and Travel Rule incorporated.
Commercial Implication
All VASP categories must engage with the licensing framework. Consultation window open. Dissertation flag: applied-regulatory.
vasp-licensingFATF🎓 Dissertation
2026-03-1225d
🇸🇳 UEMOA
BCEAO Issues Crypto Questionnaire to UEMOA FintechsPre-consultation survey, 8 member states
NBE applied existing monetary law to ban birr-paired P2P crypto trading. No new legislation. First regulatory crypto movement in an under-monitored jurisdiction.
Commercial Implication
Template for how African jurisdictions apply existing frameworks to crypto without bespoke legislation. Dissertation: applied-regulatory.
crypto-general🎓 Dissertation
2026-03-0433d
🇰🇪 KE
Kenya VASP Act 2025 — First Standalone Crypto Legislation in AfricaPresidential assent Oct 2025, in force Nov 4
First standalone crypto legislation in Africa. Full VASP licensing framework. Sets precedent for Uganda, Tanzania, and other East African jurisdictions.
Commercial Implication
All VASPs operating in Kenya must engage with the licensing framework immediately. Cross-jurisdictional signal for East Africa.
vasp-licensingexchange-regulation
2026-03-0433d
🇬🇭 GH
Ghana VASP Act 2025 — Presidential Assent December 2025Third standalone crypto law in Africa within 3 months
PDPO found Google in breach despite no physical presence. DPPA 2019 has extraterritorial application. Physical presence irrelevant. Declaratory orders only -- no fines. Covered in Issue 1. LinkedIn draft (v4) awaiting approval.
Commercial Implication
Any entity with Ugandan users must register with PDPO. Part of continental extraterritoriality pattern (KE/UG/NG).
extraterritorialityDPPA-2019
2026-03-0235d
🇳🇬 NG
NDPC Investigation into Temu — Cross-Border Transfer FocusGlobal e-commerce, NDPA 2023 cross-border enforcement
NDPC investigation into Temu for cross-border transfer breaches. Highest-profile NDPA 2023 action. Part of sector-wide investigation into 1,369 organisations.
Commercial Implication
Template enforcement action for cross-border transfer compliance under NDPA 2023. Any international platform with Nigerian users is implicated.
cross-border-transferNDPA-2023
2026-03-0235d
🇰🇪 KE
Kenya High Court Upholds Worldcoin Enforcement — KEHC 5629Landmark biometrics: consent, accountability, cross-border transfer
Most significant continental DP judgment. Three failures: consent (token incentive invalid), accountability (no governance chain), cross-border transfer (no safeguards). Covered in Issue 1. LinkedIn draft (v4) awaiting approval.
Commercial Implication
Compliance checklist for any biometric KYC, facial recognition, or biometric processing in Kenya. ODPC suo moto powers confirmed.
184 compensation orders under s.56 DPA 2019. Data subjects claim directly via ODPC without going to court. Covered in Issue 1. LinkedIn draft (v4) awaiting approval.
Commercial Implication
DSR handling process is a direct liability exposure. 184 is a baseline not a ceiling. DPO SLAs and documentation essential.
s.56-DPA-2019data-subject-rights
2026-03-0235d
🇳🇬 NG
Nigeria NDPC GAID 2025 — General Application and Implementation DirectivesCompliance baseline for all Nigeria data processors