Law: Data Protection Act, 2018 ('the Act') 

Regulator: The Information and Data Protection Commission

Summary: On 15 October 2021, upon the issuance of a commencement order in the Government Gazette by the Minister of Presidential Affairs, Governance and Public Administration, the Data Protection Act entered into effect more than three years after it was passed by the National Assembly on 12 July 2018. Organisations have a transition period of 12 months in order to bring their operations into compliance with the Act.

Once in effect, the Act will regulate data controllers and processors, provide for data subject rights and set out restrictions of matters such as direct marketing, sensitive data, and data transfers. The Act also renders consent a central principle while requiring data breach and processing notifications in certain circumstances. As such, the Act can be said, in broad terms, to echo the approach to privacy taken by the EU's General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'). In contrast to the GDPR, though, the Act will establish significant potential prison terms ranging from between three to 12 years for certain violations.