POPIA vs NDPA vs Kenya’s Data Protection Act: Marketer’s Guide
If you market across Africa, one privacy policy won't cut it
A decade ago, an African business could run email and SMS campaigns with little thought for data protection. That era is firmly over. South Africa’s Protection of Personal Information Act (POPIA), Nigeria’s Data Protection Act (NDPA) 2023, and Kenya’s Data Protection Act 2019 each now govern how businesses collect, store and use personal data — and each has a regulator empowered to enforce it. For a business operating in more than one of these markets, that means a single, copy-pasted privacy approach is not enough; you need to understand where the laws agree and where they differ.
The good news is that all three are built on the same foundations, so getting the principles right takes you most of the way in every market. The complications are in the details — the precise consent standards, the rules for direct marketing, the registration obligations — and those details are exactly where businesses get caught out. This guide compares the three from a marketer’s point of view: not a legal treatise, but a practical orientation to what you must do to run email, SMS, advertising and analytics compliantly across Kenya, Nigeria and South Africa. For binding advice on your specific situation, consult a qualified lawyer in the relevant country.
The common ground: what all three laws require
Despite their differences, POPIA, the NDPA and Kenya’s DPA share a common core, because all three draw on the same global data-protection principles that shaped Europe’s GDPR. In each market you must have a lawful basis to process personal data, and for direct marketing that basis is normally consent. You must tell people what you are collecting and why, at the point you collect it. You must keep personal data secure and use it only for the purposes you stated. People have rights over their data — to access it, correct it, and object to its use for marketing — and when someone objects or withdraws consent, you must stop. And each country has a regulator with powers to investigate and penalise non-compliance.
For a marketer, this common core translates into a universal checklist that works across all three markets: collect explicit opt-in consent, record it, explain your purpose in plain language, give an easy and working opt-out in every message, honour opt-outs promptly, secure your data, and never buy or scrape lists. Do those things and you are compliant in spirit everywhere — the country-specific details then refine the execution.
How the three laws differ for marketers
The practical differences that matter most when running campaigns.
This table is a summary for orientation, not legal advice — thresholds, exemptions and enforcement practice evolve, so confirm the current position for your specific circumstances in each market.
| Aspect | South Africa (POPIA) | Nigeria (NDPA 2023) | Kenya (DPA 2019) |
|---|---|---|---|
| Regulator | Information Regulator | Nigeria Data Protection Commission (NDPC) | Office of the Data Protection Commissioner (ODPC) |
| Marketing consent | Opt-in for electronic marketing (s69); narrow existing-customer exception | Consent required; processing must stop on objection | Consent-based; clear opt-in expected |
| Registration | Information Officer registered with the Regulator | NDPC registration for higher-volume controllers | Registration of data controllers/processors with the ODPC |
| Headline penalty | Fines up to R10 million; up to 10 years imprisonment for serious offences | Sanctions and remedial orders via the NDPC | Penalties up to KES 5 million or a percentage of turnover |
POPIA vs NDPA vs Kenya's Data Protection Act: What Marketers Need to Know
Three countries, three laws, one rule: earn consent.
South Africa: POPIA in practice
POPIA has been fully enforceable since 1 July 2021 and is enforced by the Information Regulator. For marketers, the defining provision is Section 69, which prohibits direct marketing by electronic communication unless the recipient has consented, with a narrow exception allowing you to market to existing customers about your own similar products provided they were given a chance to opt out at collection and in every message since. POPIA also requires the head of each organisation to be registered as its Information Officer, and it carries serious penalties — administrative fines up to R10 million and, for the gravest offences, imprisonment up to ten years. In practice, the South African marketer’s priorities are watertight opt-in consent, documented and demonstrable, and an easy, always-working opt-out. Our dedicated POPIA-compliant marketing automation guide goes deeper on setting this up.
Nigeria: the NDPA in practice
Nigeria’s Data Protection Act 2023 strengthened and consolidated the earlier NDPR framework and established the Nigeria Data Protection Commission (NDPC) as a dedicated regulator. For marketers, the NDPA requires a lawful basis — usually consent — to process personal data for marketing, and it gives data subjects the right to object to direct-marketing processing, at which point it must stop immediately. Higher-volume data controllers face registration obligations with the NDPC, and cross-border transfers of personal data are subject to conditions. The Nigerian marketer’s priorities therefore mirror the universal checklist, with particular attention to honouring objections promptly and to the basis for using foreign-hosted tools. Our NDPA compliance guide for digital marketing covers the detail.
Kenya: the Data Protection Act in practice
Kenya’s Data Protection Act 2019, enforced by the Office of the Data Protection Commissioner (ODPC), was among the earlier comprehensive data-protection laws in the region and has been actively enforced, including registration of data controllers and processors. For marketers, it follows the familiar pattern: a lawful basis, normally consent, is required for marketing; people must be informed and able to object; and data must be secured and used only for stated purposes. Registration with the ODPC is a notable practical step that catches out businesses which assume the law does not apply to them. Penalties can reach KES 5 million or, in some cases, a percentage of annual turnover. For a Kenyan marketer, the priorities are proper consent capture, ODPC registration where required, and honouring data-subject rights.
What to actually do across all three markets
If you operate in more than one of these countries, the practical approach is to build to the highest common standard and then layer on the country-specific requirements. Capture explicit, recorded opt-in consent at every point you collect data, with a short plain-language privacy notice explaining who you are and what you will do. Keep separate consent for separate purposes — a newsletter sign-up is not consent for SMS marketing. Include clear sender identification and a free, working opt-out in every message, and honour opt-outs promptly and permanently across every system. Secure your databases and limit access. Register where each market requires it — the Information Officer in South Africa, NDPC registration in Nigeria, ODPC registration in Kenya. And never buy, scrape or “borrow” lists, which breaches all three laws and performs poorly anyway. Build your marketing automation around these principles from the start, and compliance becomes a quiet strength rather than a recurring fire to fight. For wider context on what compliant marketing costs to set up, see our digital marketing costs guide.
Cookies, analytics and tracking across the three markets
Email and SMS get most of the attention in data-protection discussions, but for digital marketers the bigger day-to-day exposure is often website tracking — cookies, analytics and advertising pixels. Every time a visitor lands on your site and your Google Analytics, Meta pixel or remarketing tag fires, you are processing personal data, and all three laws have something to say about it. The naive setup most businesses run — every tracker firing the instant a page loads, with no consent and no notice — is the single most common compliance gap we find across Kenya, Nigeria and South Africa.
The compliant approach is consistent across the three markets even though the precise wording of each law differs. Tell visitors, clearly and before non-essential tracking begins, what you collect and why, through a genuine cookie or privacy notice rather than a buried line in the terms. Give them a real choice about non-essential cookies and trackers, rather than a fake “by using this site you agree” banner with no opt-out. Fire advertising and analytics tags only after consent where the law expects it, using proper consent management rather than firing everything on load. And document what you have done, so you can demonstrate compliance if a regulator asks.
This matters commercially as well as legally. Retargeting and analytics are powerful, but they depend on trust, and a heavy-handed, consent-free tracking setup increasingly reads as untrustworthy to the more privacy-aware consumers in all three markets — particularly in South Africa, where POPIA has raised public awareness. Getting tracking right is therefore not just about avoiding penalties; it is about building the credibility that makes every other marketing effort more effective. We configure analytics and advertising tracking to respect consent in each market while still giving you the data you need to optimise.
Make your cross-border marketing compliant
We help businesses run email, SMS, ads and automation that comply with POPIA, the NDPA and Kenya’s DPA — earning growth without the regulatory risk. Let’s review your setup across every market you serve.
Email: business@neliumsystems.com
Questions & Answers
Frequently asked questions
Can I use one privacy policy for all three countries?
You can use one well-built policy as a foundation, but it must address the specifics of each market where you operate — the relevant regulator, registration obligations and consent rules. A generic policy that names none of them satisfies none of them properly. We tailor the approach per market.
Is opt-in consent required in all three?
For electronic direct marketing, yes in substance. South Africa's POPIA is explicit about opt-in under Section 69, and both Nigeria's NDPA and Kenya's DPA require a lawful basis — normally consent — with the right to object. The safe, effective standard everywhere is genuine opt-in.
Do I need to register with a regulator?
Often, yes. South Africa requires the head of the organisation to be registered as Information Officer; Nigeria requires NDPC registration for higher-volume controllers; Kenya requires registration of data controllers and processors with the ODPC. Many businesses skip this and should not. Confirm your status in each market.
What happens if I get it wrong?
Each regulator can investigate complaints and impose penalties — up to R10 million (and imprisonment for serious offences) under POPIA, sanctions via the NDPC in Nigeria, and up to KES 5 million or a turnover-based penalty in Kenya. Beyond fines, the reputational damage and lost trust often cost more.
Can I still market effectively under these laws?
Absolutely. All three govern how you process data, not whether you can market. Compliant, consent-based marketing is entirely workable and consistently produces healthier, more engaged audiences than bought or scraped data ever did — so compliance and performance pull in the same direction rather than against each other.
, {"@type": "Article", "headline": "POPIA vs NDPA vs Kenya's Data Protection Act: Marketer's Guide", "description": "A marketer's comparison of South Africa's POPIA, Nigeria's NDPA and Kenya's Data Protection Act — consent, direct marketing rules and what to do in each.", "url": "https://neliumsystems.com/popia-vs-ndpa-vs-kenya-dpa-marketers-guide/", "author": {"@type": "Organization", "name": "Nelium Systems", "url": "https://neliumsystems.com", "sameAs": ["https://x.com/Nelium_Systems", "https://www.facebook.com/neliumsystems/", "https://www.instagram.com/neliumsystemsofficial/", "https://www.linkedin.com/company/nelium-systems/"]}, "publisher": {"@type": "Organization", "name": "Nelium Systems", "url": "https://neliumsystems.com", "sameAs": ["https://x.com/Nelium_Systems", "https://www.facebook.com/neliumsystems/", "https://www.instagram.com/neliumsystemsofficial/", "https://www.linkedin.com/company/nelium-systems/"]}}, {"@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "Can I use one privacy policy for all three countries?", "acceptedAnswer": {"@type": "Answer", "text": "You can use one well-built policy as a foundation, but it must address the specifics of each market where you operate — the relevant regulator, registration obligations and consent rules. A generic policy that names none of them satisfies none of them properly. We tailor the approach per market."}}, {"@type": "Question", "name": "Is opt-in consent required in all three?", "acceptedAnswer": {"@type": "Answer", "text": "For electronic direct marketing, yes in substance. South Africa's POPIA is explicit about opt-in under Section 69, and both Nigeria's NDPA and Kenya's DPA require a lawful basis — normally consent — with the right to object. The safe, effective standard everywhere is genuine opt-in."}}, {"@type": "Question", "name": "Do I need to register with a regulator?", "acceptedAnswer": {"@type": "Answer", "text": "Often, yes. South Africa requires the head of the organisation to be registered as Information Officer; Nigeria requires NDPC registration for higher-volume controllers; Kenya requires registration of data controllers and processors with the ODPC. Many businesses skip this and should not. Confirm your status in each market."}}, {"@type": "Question", "name": "What happens if I get it wrong?", "acceptedAnswer": {"@type": "Answer", "text": "Each regulator can investigate complaints and impose penalties — up to R10 million (and imprisonment for serious offences) under POPIA, sanctions via the NDPC in Nigeria, and up to KES 5 million or a turnover-based penalty in Kenya. Beyond fines, the reputational damage and lost trust often cost more."}}, {"@type": "Question", "name": "Can I still market effectively under these laws?", "acceptedAnswer": {"@type": "Answer", "text": "Absolutely. All three govern how you process data, not whether you can market. Compliant, consent-based marketing is entirely workable and consistently produces healthier, more engaged audiences than bought or scraped data ever did — so compliance and performance pull in the same direction rather than against each other."}}]}]}
Got a Project in Mind? Let’s Talk.
You’ve got a vision — we’ve got the team to bring it to life. Let’s discuss your goals and turn them into powerful results.
Phone: +254 710 520 510
Email: hello@neliumsystems.com
