The Network of African Data Protection Authorities proposes six routes for cross-border data transfers

The Network of African Data Protection Authorities (NADPA) has proposed six mechanisms that countries could use to authorise cross-border transfers of personal data. The draft Model Policy on Cross-Border Data Transfers was presented by Ghana’s Data Protection Commissioner at the Pan-African AI and Innovation Summit in Accra.

The proposed framework includes adequacy decisions, standard contractual clauses, binding corporate rules, certification, specific authorisation, and limited derogations. The mechanisms are intended to provide different legal routes depending on the circumstances and risk associated with a transfer.

The draft also proposes classifying data according to risk. This approach would help determine which safeguards or authorisation mechanisms should apply when personal data is transferred between countries.

A model rather than a regional rule

NADPA’s proposal is designed as a model policy rather than a set of rules that would automatically apply across Africa. Countries would retain their own national data protection laws and the authority of their national regulators.

Its practical impact would therefore depend on whether individual countries choose to adopt the proposed approaches and how they incorporate them into their domestic frameworks. The model seeks to make national systems more compatible without replacing them with a single continent-wide regime.

Cross-border data governance has become an increasingly important issue as African countries develop their digital economies and data protection frameworks. Recent regional efforts have also focused on improving cooperation and aligning national approaches. A workshop convened by UNESCO, Smart Africa and Zimbabwe’s Ministry of ICT, Postal and Courier Services, for example, brought together policymakers, regulators and technical experts from eight southern African countries to discuss data governance harmonisation.