Overall Analysis of Findings Against Indicators
The assessment focused on the companies' compliance with data protection and privacy laws in their respective countries, evaluating them against seven(7) core indicators. Each indicator includes measurable variables, with scores assigned based on the companies' adherence to data protection laws and regulations.
Registration with the National Regulator
At the country level, compliance with regulatory registration expanded significantly: whereas only two countries met this requirement last year, the number doubled to four in the current assessment. Overall registration rates rose to 88%, up from 63%, reflecting a broader, but still uneven uptake of formal compliance obligations. Kenya continued to lead, followed by Nigeria at 66%, with Uganda maintaining its previous score of 63% and Ghana reaching 53%.
Sectoral performance revealed even sharper contrasts. Banks and Finance, together with the Insurance sector, once again demonstrated the highest levels of regulatory registration, achieving an average of 97%, though slightly below last year's perfect score. In contrast, the Online Betting sector previously scoring 0% made a significant leap to 44%, although it still lagged behind other industries. Telecommunications posted solid gains at 84% (up from 75%), Digital Loans improved substantially to 63% (from 38%), and Government Agencies rose to 50% (from 38%). The Health sector, however, experienced a decline, dropping to 56% from last year's 69%. These figures highlight uneven but generally upward momentum, with some sectors advancing rapidly while others continue to struggle with registration compliance.
Accessible Privacy Policy
At the country level, all assessed jurisdictions demonstrated compliance with this indicator, though performance varied considerably. Nigeria and Kenya jointly recorded the highest score at 77%, while the weakest performer reached 58%.
Sector-level outcomes revealed a similar pattern of uneven progress. Six of the eight sectors achieved average scores above the 50% threshold, indicating generally improving transparency practices. However, Government Agencies and the Health sector, consistent with last year's results, remained the lowest performers, scoring 37% (up from 28%) and 29% (up from 22%) respectively. These persistently low results highlight structural challenges in public sector and health-related privacy communication, despite modest year-on-year improvements.
Pre-Collection Data Transparency (Data Subject Rights)
Across all countries assessed, measurable efforts toward meeting this indicator were evident, though performance levels remained modest overall. Nigeria achieved the strongest average score at 56%, a slight improvement from last year's 54%. Kenya followed with 53%, marking a marginal decline from its previous performance, while Mauritius reached 52% (up from 45%) and Uganda 50% (up from 44%). The lowest-performing country scored 34%, improving from last year's 27% but still reflecting significant gaps.
At the sector level, the Banks and Finance sector again emerged as the most compliant, posting an average score of 53% compared with 42% last year. Other sectors including Telecommunications, Online Betting, E-commerce, Insurance, and Digital Loan Services clustered below the 50% mark, indicating uneven alignment with this requirement. The Health sector remained the weakest performer, though it improved from 15% to 19%, signalling incremental progress despite persisting structural challenges.
Third-Party data transfer
At both the country and sector levels, the results show that although organisations continued to demonstrate some effort toward meeting this indicator, overall performance remained below the 50% threshold, consistent with last year's pattern. Six out of nine countries had demonstrable compliance and Uganda recorded the highest score at 26%, up from 21%, while Nigeria and Mauritius followed closely at 23% each. These figures underscore the persistent challenges in achieving substantive compliance, with progress occurring only in incremental steps.
Practice Robust Data Security
At the country level, all assessed nations showed increased efforts to comply with the indicator. Nigeria led with the highest score of 62%, improving from 59% last year, followed by Mauritius and Uganda at 59% each (Mauritius up from 57%), and Botswana at 56%. Kenya maintained a consistent score of 55%, while the lowest score remained unchanged at 43%.
At the sector level, Banks and Finance once again topped the rankings with a score of 54%, up from 48%, whereas all other sectors continued to score below 50%, highlighting persistent gaps in compliance outside the leading sector.
Availability of a Transparency Report
At both the country and sector levels, compliance with this indicator remained generally low despite noticeable efforts. Mauritius emerged as the highest-performing country, achieving 26%, a substantial increase from 10% last year, followed by Kenya and Botswana at 22% each, Kenya showing significant improvement from 0%. The lowest country score remained at 3%, unchanged from the previous year.
At the sector level, Banks and Finance led with 27%, up sharply from 3%, followed by Insurance at 25% (up from 9%) and Telecommunications at 23% (up from 13%). All other sectors recorded scores of 7% or lower, highlighting persistent weaknesses and indicating that targeted interventions are needed to raise compliance across the broader landscape.
Internal Data Breach Resolution
At both country and sector levels, performance against this indicator remained generally low despite observable compliance efforts. Tanzania and Nigeria led the country rankings with 13% each, Tanzania showing a notable improvement from 4% and Nigeria up from 11%, followed closely by Uganda at 12%. The lowest country score was 3%, a slight increase from 1% last year.
Within sectors, Banks and Finance and Telecommunications topped the performance chart at 13% (up from 7%), followed by E-commerce at 10% (up from 7%). All remaining sectors scored 8% or below, highlighting persistent gaps in compliance and the need for targeted capacity-building and enforcement strategies to strengthen adherence across the board.