African Union: African Union Convention on Cyber Security and Personal Data Protection including provisions on cross-border data transfer regulation entered into force

On 8 June 2024, the African Union Convention on Cyber Security and Personal Data Protection entered into force. The Convention stipulates that personal data should not be transferred to non-Member States unless those states ensure an adequate level of protection for privacy and fundamental rights. In cases where adequate protection is not guaranteed, data controllers must seek authorisation from the national protection authority before transferring the data.