The African Continental Free Trade Area promised to harmonize trade rules across 54 countries. It has failed to deliver a binding framework for data governance—the infrastructure on which every cross-border digital transaction depends.
When a Nigerian fintech wants to serve customers in Kenya, Ghana, and Egypt simultaneously, it does not face a unified continental standard. Instead, it confronts four separate national data protection regimes: Nigeria's Nigeria Data Protection Regulation (NDPR), Kenya's Data Protection Act, Ghana's Data Protection Act, and Egypt's Data Protection Law. Each imposes different consent requirements, data residency rules, and breach-notification timelines. None references the others. None has a continental arbiter to resolve conflicts.
The result is regulatory fragmentation that advantages foreign platforms over African competitors. A US SaaS platform entering Africa needs one compliance department trained in GDPR-adjacent standards; it scales that template across the continent. A Lagos-based fintech scaling to East Africa must either hire separate legal teams in Nairobi and Kigali, or operate in legal grey zones where enforcement is inconsistent.
The structural gap is concrete: AfCFTA's digital trade protocol, ratified by the African Union in 2023, contains no binding data governance code and establishes no continental dispute-resolution body for data protection violations. Member states retain sovereignty to set their own standards, but they have not coordinated those standards. The result is not diversity—it is chaos dressed in the language of national sovereignty.
Nigeria, Africa's largest economy and home to a $29 billion fintech ecosystem, lacks the digital policing infrastructure to enforce even its own NDPR at scale. Source: Inside Nigeria's Digital Policing Flaws and the Future of Public Infrastructure Kenya's data authority operates without explicit jurisdiction over cross-border data flows. South Africa's Information Regulator has issued guidance but cannot enforce compliance across AfCFTA borders. The absence of a continental data enforcement body means that violations of one country's standard in another country's jurisdiction remain unresolved—forcing fintechs to over-comply with the most restrictive rule set as a risk-mitigation strategy.
This over-compliance is not regulation; it is a tax on African ambition. A Nairobi-based payments startup expanding to Nigeria must implement Egypt-grade data residency controls across all operations—not because Egypt's law applies to its operations in Kenya, but because avoiding any possible regulatory dispute is cheaper than fighting it. The cost of that defensive compliance is built into product pricing, reducing competitiveness against foreign entrants.
What remains unresolved: The African Union has not published a timeline for a continent-wide data governance code. Member states have not signaled whether they will align on GDPR-influenced standards (emphasizing individual consent and cross-border data flows) or adopt a sovereignty-first framework (privileging state control and data localization). Some signals suggest a middle path: the draft AU AI Accord, co-developed by Rwanda and Egypt, hints at a more sovereignty-conscious approach than GDPR, but that instrument does not yet address data protection explicitly.
Without clarity from the AU, African digital businesses are defaulting to bilateral agreements with individual countries—a workaround that defeats the purpose of a continental trade area. Equity-backed fintechs can absorb this friction. Bootstrapped startups cannot. The effect is consolidation around the largest, best-funded founders in Lagos, Nairobi, and Cape Town—exactly the opposite of the democratization AfCFTA was meant to enable.
The opportunity: This regulatory void has created an immediate market for compliance-as-a-service firms specializing in pan-African data governance. A Lagos-based compliance consultancy or a Cape Town-based regulatory tech platform that maps national rules into a unified framework could capture founders willing to pay for clarity. Simultaneously, the AU's failure to act creates political space for regional sub-frameworks—the East African Community, WAEMU, or the Southern African Development Community could each establish binding data standards for their members, fragmenting the continent further but offering startups at least one level of predictability.
Regulators in Nigeria, Kenya, and South Africa should jointly advocate at the next AU summit for a continental data authority with binding arbitration powers—not to eliminate national sovereignty, but to coordinate it. Startups should treat AfCFTA's data governance vacuum not as a barrier, but as a call to build the compliance infrastructure that the continent's institutions have left empty.
What to watch: the AU's response to the next high-profile cross-border data breach in an AfCFTA member state—if enforcement falls to individual countries with no continental standard, expect member states to unilaterally restrict data flows, further fragmenting the digital single market.