Africa Data Watchdogs Hand Down Fines, Prison Terms As Enforcement Ramps Up

Africa’s digital economy is entering a new phase of regulatory enforcement as 45 countries adopt data protection laws and 16 roll out national artificial intelligence strategies, according to a 2026 report by stablecoin infrastructure provider Yellow Card.

The report found that 39 data protection authorities are now fully operational across the continent, marking a significant shift from policy adoption to active enforcement.

Uganda secured its first criminal data conviction in July 2025, imprisoning a director of a digital lender for using personal data without consent, the report. Nigeria’s Data Protection Commission fined MultiChoice USD 500 K for “patently intrusive” privacy violations and dragged Meta into a settlement over data breaches, though new details of the agreement have caused some dissatisfaction.

In Kenya, banking, energy, and telecom firms have all been fined by the Office of the Data Protection Commissioner. Tanzania’s High Court imposed a fine on a company that used a newborn’s photo on Instagram without the mother’s consent.

Meanwhile, AI governance is emerging as the next regulatory frontier. Sixteen African countries have adopted national AI strategies, with Nigeria, Angola, Morocco and Namibia advancing toward binding legislation. Angola’s draft AI law proposes fines of up to USD 1.6 M and prison sentences of up to 12 years for intentional misuse.

“The ability to innovate and modernise payment rails is deeply tied to navigating complex cross-border regulatory landscapes,” Thelma Okorie, Yellow Card’s group data protection and privacy counsel and author of the report, said in a statement.

For financial institutions using stablecoins for treasury management and cross-border payments, times are changing. Regulators are increasingly requiring Data Protection Impact Assessments and Algorithmic Impact Assessments before deployment, raising compliance costs for non-adherent firms.

“Stablecoins are powerful tools for business efficiency and mitigating FX volatility risk,” Okorie added. “But the infrastructure powering them must operate in lockstep with the strictest data protection and AI governance frameworks.”