世界银行-非洲数字数据监管（英）-2024-46页_1mb

Summary: Regulating Data Protection and Cybersecurity in Africa: Findings from the Global Data Regulation Diagnostic

Personal Data Protection

• Over 50 African countries have introduced general data protection legislation.
• Progress includes adopting principles like purpose limitation and data minimization.
• Enforcement challenges include lack of capacity in Data Protection Authorities (DPAs) and delayed implementation.
• Regional efforts exist, but implementation gaps remain significant across many countries.

Cybersecurity and Cybercrime

• Regulatory environment for cybersecurity is underdeveloped, with few comprehensive measures.
• Countries like Mauritius show leadership with full security requirements for automated processing.
• Cybercrime legislation is more widespread, but effective enforcement is lacking.
• Establishing CERTs and CSIRTs is critical but not common across the continent.

Data Governance and Cross-Border Flows

• Legal frameworks exist, but limited enforcement capacity creates challenges.
• Cross-border data transfers face regulatory fragmentation and high costs for businesses.
• Data localization policies are debated, with mixed implications for sovereignty versus digital participation.

Comparative Assessment

• African countries show performance similar to upper-middle-income nations but lag high-income countries.
• The digital divide remains pronounced in areas like data portability and open data policies.
• Regional communities and international frameworks offer pathways for harmonized regulation.

Key Recommendations

• Strengthen implementation capacity for data protection and cybersecurity rules.
• Enhance regional initiatives for harmonizing data governance.
• Join international conventions to create interoperable frameworks.
• Balance data sovereignty objectives with investment in digital infrastructure and capacity building.