Middle East and Africa

Egypt issues the Executive Regulations to its Personal Data Protection Law, starting a one-year transition.

The Nigeria Data Protection Commission’s General Application and Implementation Directive (GAID) 2025 takes effect, adding detailed compliance requirements under the NDPA.

Israel’s Amendment 13 to the Protection of Privacy Law expands enforcement powers, fines and DPO requirements.

Joint Standard 2 of 2024 now applies to South African financial institutions, setting principle-based cybersecurity and cyber resilience requirements.

Saudi Arabia’s Personal Data Protection Law is now fully enforceable after a one-year grace period.

Nigeria’s President signs the Nigeria Data Protection Act 2023, establishing the Nigeria Data Protection Commission and a comprehensive, extraterritorial data protection regime.

The African Union Convention on Cyber Security and Personal Data Protection enters into force, nine years after adoption.

Tanzania’s Personal Data Protection Act 2022 comes into force, establishing a Personal Data Protection Commission and registration requirements.

Oman’s Personal Data Protection Law, issued by Royal Decree 6/2022, comes into force one year after publication.

The UAE’s first federal personal data protection law, Federal Decree-Law 45 of 2021, takes effect.

Rwanda publishes Law No. 058/2021 on personal data protection and privacy, introducing registration and data localisation requirements.