Expanding across East Africa? A data protection checklist

Regional expansion is the growth path for many East African tech companies. But each market has its own data protection law, its own regulator and its own rules. Launching without checking them can stall your expansion or lead to enforcement action.

One region, four regimes

• Kenya: Data Protection Act, 2019, regulated by the ODPC. Kenya guide →
• Uganda: Data Protection and Privacy Act, 2019, regulated by the PDPO. Uganda guide →
• Tanzania: Personal Data Protection Act, 2022, regulated by the PDPC. Tanzania guide →
• Rwanda: Law No. 058/2021, regulated by the NCSA. Rwanda guide →

The laws share a common foundation, but registration processes, breach notification timelines and data storage rules differ. Being compliant in Kenya does not make you compliant in Rwanda.

The expansion checklist

1. Register in each market. Most regimes require registration before you process personal data locally.
2. Map your data flows. Know which users' data is stored where, and which teams and vendors can access it.
3. Check data storage rules. Some markets restrict storing personal data abroad. Rwanda, for example, requires authorisation.
4. Plan cross-border transfers. Moving data between your country offices or to cloud providers abroad needs a legal basis and safeguards.
5. Localise your privacy notices. Update them to reflect each country's law and regulator.
6. Align breach response. Your incident plan must meet the shortest notification deadline among the markets you operate in.
7. Review your vendors. Make sure payment, cloud, SMS and analytics providers meet each market's requirements.
8. Assign responsibility. Decide who owns data protection in each market, or appoint an outsourced DPO to cover them all.

Build it once, comply everywhere

The most efficient approach is to build to the strictest common standard: consent capture, audit logs, role-based access, data retention controls and a strong breach response. Then handle each country's registration and local rules on top.

How Solfa Tech helps

We help tech companies expand across the region with confidence: one team that handles registration in each market, reviews your product, and acts as your outsourced DPO across borders.

This guide is general information, not legal advice. Laws and regulator practice change, so confirm specifics for your situation.