Data protection: the filings a property platform needs across 54 African countries

A property platform that receives buyer enquiries from Kenya, Ghana or Côte d'Ivoire processes personal data in each of those countries, even if its publisher and its servers are elsewhere. Of the 54 African countries, about twenty have an active data protection authority that expects a filing (registration, notification or authorisation), about fifteen have a law but no working authority, and about ten have no general data protection law yet. This article describes the method we follow at imonga to map these obligations country by country, rank them by priority and prepare the filings, with the official source for each point. It does not replace advice from a lawyer in each country.

Why a foreign platform is in scope

Many publishers assume that an African data protection law only applies to companies established in the country. That is true of some laws and false for others. Everything depends on the article that sets the "territorial scope". There are three families:

• The offer-of-services test. The law applies as soon as you offer a service to people in the country, even for free. Benin's Digital Code (Law 2017-20, art. 381) covers a controller "not established in the Republic of Benin" when the processing relates to offering goods or services, "whether or not payment is required". Niger (Law 2022-59, art. 4) and Uganda (Data Protection and Privacy Act) follow the same logic.
• The origin-of-data test. Ghana (Data Protection Act 2012, Act 843, s.45) applies its law to any information that "originates partly or wholly" from the country. A purchase enquiry sent from Accra is enough.
• The means-of-processing test. Senegal (Law 2008-12, art. 2), Gabon and Algeria cover a controller that "uses means of processing located on the territory". A platform hosted in Europe does not, unless the user's phone is treated as a means of processing, a reading some authorities defend.

Before looking for a form, you therefore need to read that article for each country. It tells you whether you have to file anything, and it is the first column of our table.

What a property platform actually processes

A filing describes processing activities, so you have to list them before filling anything in. For imonga they are:

• user accounts (name, email, optional phone number);
• information and purchase enquiries, forwarded by email to the developer or agency concerned;
• listings published by individuals and professionals;
• the directory of developers and agencies, built from public information;
• business prospecting towards those professionals, by email and messaging;
• hosting and technical providers: server, email delivery, attack protection.

Each of these activities triggers separate obligations. Forwarding an enquiry to a developer is a disclosure to a third party. Hosting outside the country is an international transfer. Prospecting falls under direct marketing rules, which are often stricter than the rest of the law.

The four kinds of filings to plan for

For each country we look for four things, in this order:

1. Registration or notification with the data protection authority. This is the most common filing. Depending on the country it is a paid registration (Kenya, Ghana, Uganda), a prior notification with a receipt (Morocco, Senegal, Benin), or an authorisation, required for instance in Côte d'Ivoire as soon as a file contains phone numbers.
2. Authorisation to transfer data out of the country. Several laws forbid sending data to a country without "adequate" protection unless authorised. Morocco requires a separate form (F118) after the notification, Benin an authorisation from the APDP, Rwanda an authorisation to store data outside its territory.
3. Prospecting rules. No filing here, but rules that decide what you may send. Côte d'Ivoire makes prospecting without consent a criminal offence (Law 2013-450, art. 22). Cameroon requires consent even towards a company. Benin allows it towards an impersonal company address (art. 333). South Africa allows a single request for consent.
4. Property and tax obligations. Some property laws target listing sites: article 462 of the Ivorian Construction Code (Law 2019-576) requires an approval for operators of websites publishing rentals, on pain of the site being blocked. Ghana (Real Estate Agency Act 2020) requires a broker licence once listings are paid for. On the tax side, VAT for non-resident digital service providers only applies from the first sale.

The method: one table, one source per row

We split the continent into three research zones (West and Central, East and Southern, North). For each of the 54 countries we filled in the same table:

Column	What goes in it
Filing	Registration, notification, transfer authorisation, licence, VAT
Authority	Its exact name and filing portal
Legal basis	The law and article, read in the official text whenever possible
Applies	Yes, no or uncertain, with the reason (territorial scope)
Cost and time	Official fees, response time, what the authority's silence means
Priority	High, medium or low
Source	The link to the text or the authority's page

Two rules prevented a lot of mistakes. First, a statement without a source is marked "unverified", never presented as settled. African authorities' websites are often incomplete, moved or offline. Law firm summaries are useful but sometimes out of date. Second, we separate the text we read from secondary sources. A law firm's analysis helps you find your way, but it is not the official gazette.

How we set the priority

An obligation does not carry the same weight everywhere. A law without a working authority produces no inspections and no penalties. An authority that publishes the list of late filers does. We therefore rank each filing on two questions: does the law really apply to a foreign platform, and is the authority active?

• High: the law applies and the authority inspects, sanctions or publishes decisions. In Ghana, the Data Protection Commission announced in October 2026 that it had registered 2,575 data controllers and was pursuing 250 late filers. In Uganda, the authority applied its law to Google in 2025.
• Medium: the authority is active, but whether the law reaches a foreign publisher is uncertain (Senegal, Burkina Faso, Gabon, Mauritania), or the filing will only arise with a paid activity.
• Low: no general data protection law (Guinea-Bissau, Liberia, Sierra Leone, Mozambique, Eritrea, South Sudan, Libya, Sudan), or a law whose authority does not exist yet (Congo, Central African Republic, Equatorial Guinea, Cameroon, DR Congo).

This ranking is dated. An authority can open its portal next month. We review it every quarter.

What the map shows: the countries to handle first

Country	Filing	Authority and portal	Indicative cost
Kenya	Registration as a data controller	ODPC, dataportal.odpc.go.ke	KES 4,000
Ghana	Registration as an "external company", then with the DPC, renewed every two years	Data Protection Commission, app.dpc.gov.gh	GHS 156 to 2,340 depending on size
Nigeria	Registration and a data protection officer	NDPC, ndpc.gov.ng	Depends on the volume processed
Benin	Notification and transfer authorisation	APDP, service.apdp.bj	Not published; 60 days of silence from the APDP count as approval
Côte d'Ivoire	Processing authorisation and transfer authorisation	ARTCI, certinumapdp.ci	XOF 200,000 per authorisation; silence counts as refusal
Uganda	Registration	PDPO, pdpo.go.ug/register	About UGX 100,000 a year (secondary source)
Rwanda	Data controller certificate and authorisation to store outside the country	NCSA, dpo.gov.rw	Not published
Eswatini	Registration of controllers based outside the country (decision of 1 March 2024)	ESCCOM	E 500, once
South Africa	Information Officer registration, national opt-out registry	Information Regulator, NCC	Free
Morocco	Notification (form F211), then transfer request (F118)	CNDP, cndp.ma	No fees listed; receipt within 24 hours
Egypt	Processing, transfer and marketing licences	PDPC	Not published; filing reserved to an Egyptian representative

The most common obstacle: local presence

The map reveals a recurring obstacle: several authorities only accept a filing from a person or company of the country.

• In Côte d'Ivoire, Decree 2015-79 reserves filing to a resident or a company incorporated in Côte d'Ivoire.
• In Egypt, the authority's portal requires an Egyptian digital identity.
• In South Africa, the Information Officer must be a person present in the country.
• In Tunisia, Law 2004-63 (art. 22) reserves the controller role to a resident Tunisian.
• In Ghana, registering with the Commission first requires registering the company as an "external company".

For a young platform, the answer is not to set up a subsidiary in every country. A local agent, a law firm or a partner already on the ground (a property agency, for instance) can make the filing. You need to plan for it in the budget and the timeline, because these filings take weeks.

Transfers: the point everyone forgets

A platform hosted in Europe or North America transfers, by design, its African users' data out of their country. Several laws require a specific authorisation for this, separate from the notification:

• Morocco only examines the transfer request once the notification is accepted (form F118, opinion within two months);
• Benin requires authorisation for any transfer to a country outside ECOWAS (art. 407-6);
• Rwanda distinguishes authorisation to store and to transfer outside the country;
• Zambia goes further and requires local storage for some data (Data Protection Act 2021, s.70), which calls for a lawyer's opinion before opening the country.

Transfers are not only about the host. When a purchase enquiry goes from Abidjan to a developer based in another country, that is a transfer too. You need to list every recipient: host, email delivery service, analytics tools, and the professionals who receive the enquiries.

The publisher's own country matters too

imonga is published by a Quebec company. Quebec's private-sector privacy law (known as "Law 25") follows the company everywhere. It requires no filing with the Commission d'accès à l'information. It does require a privacy impact assessment before any disclosure of personal information outside Quebec, a written agreement with each recipient and an incident register. Canada's anti-spam legislation also applies to commercial messages sent from Canada, with an exemption for listed countries whose local law you comply with.

The lesson applies to every publisher: add your own country to the table, even if you have no customers there.

The tools we use

This work was carried out with an artificial intelligence agent (Anthropic's Claude Code), tasked with reading the texts, filling in the table and flagging what it could not confirm. Three choices made the result usable:

• Parallel research by zone, each with the same brief and the same table format. The result is comparable from one country to the next.
• Specialised modules ("skills") for repetitive tasks: record of processing, impact assessment, data processing agreement, transfer impact assessment. We use a selection from the open-source repository Privacy & Data Protection Skills (Apache 2.0 licence), which covers Nigeria, South Africa and Canada among others. These modules start from the European model (GDPR). They have to be adapted to each African law, which has its own thresholds and deadlines, and should not be applied as they are.
• Up-to-date African references to check the result: Data Protection Africa (profiles of the 55 states), Law Lab Africa's tracker of laws and decisions, and AfricanLII for the texts.

An agent speeds up research, but it is sometimes confidently wrong. Hence the rule of one source per row and "unverified". The final word belongs to a lawyer in the country.

Our timeline

At the time of writing, the map is complete and the filings are being prepared, in this order:

1. countries where the law applies, the authority is active and filing can be done online without a representative: Kenya, Ghana (after registering the company), Benin, Uganda, Rwanda, Eswatini;
2. the internal documents required by the publisher's country: record of processing, transfer assessment, agreements with providers;
3. countries that require a local representative: Côte d'Ivoire, Egypt, South Africa;
4. medium-priority countries, as checks progress;
5. non-resident VAT, before the first sale.

We will update this article as the filings progress, including the difficulties we run into with the authorities' portals.

If you are doing the same work: the checklist

1. List your real processing activities: accounts, enquiries, listings, directory, prospecting, providers.
2. For each country, read the territorial scope article before looking for a form.
3. Check that the authority exists and works: an online portal, published decisions, inspections.
4. Separate the notification from the transfer authorisation: they are often two files.
5. Read each country's prospecting rules before writing to a professional.
6. Look for property laws that target listing sites.
7. Identify the countries that require local presence and budget for an agent.
8. Add your company's country to the table.
9. Record the source of every row and mark as "unverified" what you have not read.
10. Have a lawyer in the country validate high-priority points before filing.

This guide describes a method and the state of the texts we consulted in October 2026. Laws and procedures change fast across the continent: check each point with the authority concerned before acting.