Regulators by country

Data protection regulators in Africa

Last checked 24 October 2026 · 9 sources

Short answer

The three regulators publish different kinds of records. South Africa's Information Regulator posts enforcement notices and infringement notices, including a R1,000,000 fine on a bank in October 2026 ^1,3. Kenya's ODPC publishes determinations by year and has issued penalty notices, including KSh 5,000,000 against Oppo Kenya in December 2022 ^6,7. Nigeria's NDPC reported 146 investigations in 2025 and describes a restorative approach that uses remedial fees ⁸.

South Africa, infringement notice to First National Bank: R1,000,000, signed 21 October 2026 ³
South Africa, infringement notice to Central Johannesburg TVET College: R500,000, signed 9 October 2026 ⁴
Kenya, maximum penalty notice: KSh 5 million or 1% of annual turnover, whichever is lower ⁵
Kenya, penalty notice to Oppo Kenya: KSh 5,000,000, 21 December 2022 ⁶
Nigeria, investigations: 213 in 2024, 146 in 2025 ⁸

South Africa: Information Regulator

The Information Regulator enforces the Protection of Personal Information Act (POPIA). Its enforcement notices page lists notices from May 2023 to October 2026 against recipients including public bodies, a bank, a pharmacy chain, a college and WhatsApp ¹.

An enforcement notice orders steps, not a fine. The notice to the Department of Justice and Constitutional Development, dated 9 May 2023, followed a ransomware attack in which about 1,204 files were exfiltrated. The Regulator found breaches of the security and notification sections of POPIA. It ordered nine actions within 31 days, including renewing security licences and updating the incident response plan. It said the department could appeal within 30 days ².

An infringement notice carries an administrative fine. On 21 October 2026 the Regulator signed a notice fining First National Bank R1,000,000 for an offence linked to processing a data subject's account number ³. On 9 October 2026 it signed a notice fining Central Johannesburg TVET College R500,000 for failing to comply with an enforcement notice ⁴. In each case the recipient has 30 days to pay, arrange instalments, or elect to be tried in court ^3,4.

Kenya: Office of the Data Protection Commissioner

The ODPC enforces the Data Protection Act, 2019. Section 63 caps a penalty notice at five million shillings, or for an undertaking one per cent of the previous year's annual turnover, whichever is lower. Section 64 gives a right of appeal to the High Court against administrative action, including enforcement and penalty notices ⁵.

The ODPC fined Oppo Kenya KSh 5,000,000 on 21 December 2022. It said the company had not complied with an enforcement notice of 3 November 2022, issued after a complainant's photo was used in an Instagram story without consent ⁶.

Determinations on complaints are made under Regulation 14 of the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021. The ODPC publishes them on separate pages for 2023, 2024, 2025 and 2026 ⁷.

Nigeria: Nigeria Data Protection Commission

The NDPC enforces the Nigeria Data Protection Act, 2023. Its Annual Report 2025 gives 213 investigations in 2024 and 146 in 2025, without splitting opened and concluded cases. It reports compliance revenue of 4.99B for 2025, without stating the currency ⁸.

The report says the Commission takes a restorative rather than punitive approach. It cites section 48(2)(d) of the Act, which allows remedial fees in place of strict penalties ⁸. The report does not list fines by company or give breach notification counts ⁸.

In June 2024, Techeconomy reported that the NDPC had imposed a total of N400 million in fines on seven companies. It said the action targeted four banks and three other institutions, and did not name the firms fined ⁹.

How the record types compare

Country	Order to act	Money penalty	Where to read it
South Africa ¹	Enforcement notice under POPIA section 95 ¹	Infringement notice under section 109 ³	Enforcement notices page ¹
Kenya ⁵	Enforcement notice ⁶	Penalty notice under section 63 ⁵	Determinations and press releases ⁷
Nigeria ⁸	Investigation and remedial measures ⁸	Remedial fees under section 48(2)(d) ⁸	Annual Report 2025 ⁸

Common questions

Can the Information Regulator fine a company in South Africa?

Yes, through an infringement notice. In October 2026 it signed notices of R1,000,000 against First National Bank and R500,000 against Central Johannesburg TVET College ^3,4.

What is the maximum fine under Kenya's Data Protection Act?

Up to five million shillings, or for an undertaking up to 1% of the previous year's annual turnover, whichever is lower ⁵.

Can a Kenyan penalty notice be appealed?

Yes. Section 64 allows an appeal to the High Court against administrative action by the Data Commissioner, including penalty notices ⁵.

Does Nigeria's NDPC publish a list of fines?

Its Annual Report 2025 does not list fines by company. It reports investigation counts and compliance revenue ⁸.

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.

Sources

Breach notification rules compared
Breach notice deadlines and triggers in the EU, UK, US, Canada, Australia, Singapore, India and Brazil, from laws and regulator pages.
What counts as a personal data breach
How the GDPR, the UK ICO, US HIPAA, Canada, Australia and Brazil define a personal data breach, with official examples and reporting tests.
Data protection regulators in Asia-Pacific
Breach figures, penalties and powers of privacy regulators in Australia, New Zealand, India, South Korea and Japan, from official releases.
Data protection regulators in Latin America
Regulators, sanctions and breach rules in Brazil, Chile, Argentina and Colombia, from the laws and the regulators' own pages.
What a regulator reprimand means
A reprimand is a formal finding of a breach without, or alongside, a fine. How the GDPR, the UK ICO, Ireland's DPC and France's CNIL use reprimands.