According to a report shared by Nigeria’s Federal Competition and Consumer Protection Commission (FCCPC), an investigation was launched in 2021 into Meta Platforms and its subsidiary, WhatsApp, uncovering a pattern of exploitative practices. The investigation covered the following key areas: the conduct, privacy practices, and consumer data policies of Meta Platforms and WhatsApp. Following a 38-month joint investigation, the FCCPC issued a final order imposing a $220 million fine in July 2024, with additional fines of $35,000 as investigation expenses, the highest penalty so far imposed on a major tech platform by a global majority country. Meta responded by threatening to shut down Facebook and Instagram in Nigeria, following what it described as ‘unrealistic’ demands.
This episode goes a long way toward telling the story of power asymmetry, with continued cases of privacy breaches and refusals to uphold the legislature, even when found guilty, which would not happen in the European Union, India, or even the United States of America. Judging from this, one is led to ask: Does Africa have the power to enforce its right to govern its own data?
Figure 1. An infographic of the META vs FCCPC case
The tension in Africa’s data economy is between three actors: global tech platforms that extract and store data offshore, African states seeking regulatory sovereignty over their nationals’ data, and African citizens who are largely unaware of how data moves, where it goes, and whose interests it serves. Understanding how African states are navigating this tension requires understanding what is at stake.
According to the African Union (AU), data governance, at a macro level, presents an opportunity to use standards, rules, norms, and principles as mechanisms to mitigate identified data risks and harms while advancing the development of the data economy and digital dividends. It covers personal, non-personal, industrial, and public data protection. The United Nations Economic Commission for Africa (UNECA) further defines digital sovereignty as a nation's ability to control, secure, and govern its own digital infrastructure and data. Américo Muchanga, Mozambique’s Minister of Communications and Digital Transformation, described it as being as vital today as electricity.
Globalisation and the AI revolution are two factors that keep compounding the urgency of owning one’s data, and a nation that neglects it risks becoming what analysts describe as a ‘cold state’--absolutely reliant on other nations for its data infrastructure, resources, or centres. This would leave them exposed to hacking, data breaches, leaks, and data monopolies, in which the state has barely any say over the movement of data within its borders. According to a report from the UNECA, Africa currently accounts for 20% of the global population but only 1% of global data.
In an episode of The Afropolitan Podcast, a founder in Africa’s data infrastructure space stated that critical national systems that rely on infrastructure controlled from outside a country's borders represent a structural vulnerability. Africa must win in its bargaining for data governance and digital sovereignty; if not, it risks modern-day slavery–data colonisation–in which the continent’s data fuels global AI models and digital platforms, yet the economic value and infrastructure flow outward, confining Africa to imported intelligence, and weakening the continent’s already fragile innovation ecosystem.
Africa has made significant strides, with 45 African countries having data protection legislation in place and 39 regulatory authorities fully operational, according to Yellow Card.
At the national level, Nigeria’s Data Protection Regulation (NDPR), Kenya's Data Protection Act, and South Africa's Protection of Personal Information Act (POPIA), amongst others, provide a clear view of each country’s efforts in the negotiation. At the regional level, the Economic Community of West African States’ (ECOWAS) Supplementary Act on Personal Data Protection creates a binding framework across West Africa, signalling that African states are also negotiating collectively. At the continental level, the African Union Data Policy Framework sets the architecture for harmonised governance across 55 nations, the clearest signal yet that Africa intends to negotiate from a unified position. There have also been several data centres set up across Africa in Senegal, Angola, Ghana, Mauritius, Tanzania, Morocco, Egypt, Kenya, Nigeria, South Africa, etc., to ensure that Africa’s data stays in Africa.
Nevertheless, the terms of this negotiation remain largely skewed. Regulation without governance is a weak bargaining position. The Meta case illustrates this: Nigeria won in court twice, and the fine remains unpaid. However, these regulations further stifle progress through persistent data silos, overly restrictive data localisation and cross-border transfer restrictions. These restrictions limit foreign direct investment, place disproportionate burdens on groups such as those requiring integrated data, SMEs and startups, and participants in intra-African trade, and ultimately hinder economic growth.
A balance is required, with equal focus on enablers such as data portability, interoperability, and responsible localisation, which are just as crucial to unlocking a robust, future-oriented digital economy. Data centres, while necessary, face real constraints on a continent where resources are limited, and the environment for growing current human resources is constrained. With the drive for sustainability, data centres are not as easy to set up, given their high water and energy consumption in areas lacking economic and physical access to water.
The negotiation is real and ongoing, but its outcome is not yet decided. However, African states have moved from having no seat at the table to building legal frameworks, issuing landmark fines, and asserting the right to govern data generated on their soil. It is also pertinent to note that asserting a right and enforcing it are two different things. The gap between these two actions is where the terms of Africa's data economy will ultimately be decided.
References
African Union Commission. (2022). AU data policy framework. African Union Commission.
Economic Community of West African States. (2010). Supplementary act A/SA.1/01/10 on personal data protection within ECOWAS. ICT Policy Africa. https://ictpolicyafrica.org/en/document/z69cbq7b51
Gyekye, A. (2026, March 30). Breaking data barriers: How data governance across Africa will define the continent's AI future. Microsoft News.
Jaiyeola, T. (2024, July 23). Timeline of Nigeria’s Meta $220 million case. BusinessDay. https://businessday.ng/technology/article/timeline-of-nigerias-meta-220-million-case/
Lai, C. (2022, July 8). Water scarcity in Africa: Causes, effects, and solutions. Earth.Org. https://earth.org/water-scarcity-in-africa/
National Information Technology Development Agency. (2019). Nigeria Data Protection Regulation 2019. https://nitda.gov.ng/wp-content/uploads/2020/11/NigeriaDataProtectionRegulation11.pdf
Nwachukwu, N. (2026, February 4). The great exit: Why top engineers are dumping fintech for hard tech startups [Audio podcast episode]. T. A. Podcast.
Ogbayabona, O. V. (2025, November 23). The cost to keep up with the AI boom in Nigeria, Africa. BusinessDay. https://businessday.ng/opinion/article/the-cost-to-keep-up-with-the-ai-boom-in-nigeria-africa/
Olasupo, F. (2025, November 25). Top 10 African countries by number of data centres, 2025. The African Exponent. https://www.africanexponent.com/top-10-african-countries-by-number-of-data-centres-2025/
Republic of Kenya. (2019). Data Protection Act, 2019. Kenya Law. https://new.kenyalaw.org/akn/ke/act/2019/24/eng@2022-12-31
Republic of South Africa. (2013). Protection of Personal Information Act 4 of 2013. South African Government. https://www.gov.za/documents/protection-personal-information-act
United Nations Economic Commission for Africa. (2026, May 11). Africa pushes for data sovereignty and digital independence. Africa Renewal.
