ECOWAS Data Protection Act
Market regime · ECOWAS Supplementary Act on Personal Data Protection (2010)
ECOWAS
West Africa (ECOWAS)
Adopted 2010; transposed by member states
National data-protection authorities of member states
The regional baseline West African national laws transpose
Curated, versioned & cross-mapped
The obligation, plainly.
The ECOWAS Supplementary Act on Personal Data Protection set the regional baseline in 2010: principles of lawful processing, data-subject rights, security obligations and the requirement that member states establish protection authorities. Nigeria's, Ghana's and the region's national laws descend from it.
It is curated as the reference layer: where a member state's national law is thin or still maturing, the Supplementary Act explains the floor an institution should build to, and the cross-mapping shows how the same controls satisfy each national descendant.
Where programmes are tested.
The regional principles
Lawfulness, purpose, proportionality and retention discipline as the common denominator of the region's laws.
Rights and security
Data-subject rights and security obligations that national acts operationalise.
Authorities established
Member states obliged to create protection authorities, the institutional map of the region.
Curated once, evidenced continuously.
- Curated as the baseline layer beneath the Nigerian and Ghanaian acts, cross-mapped to the same privacy controls so regional posture is one implementation read three ways.
- Requirements resolve to shared controls: implement a control once and it counts toward every framework it maps to.
- Status is evidence-gated: a requirement can't be marked implemented without valid, in-date evidence behind it.
- Every attestation carries maker/checker, and every action lands in an append-only audit trail.
ECOWAS Data Protection Act, asked plainly.
The questions compliance teams actually ask before an adoption decision or an audit.
Is the Supplementary Act directly binding on companies?
It binds member states, which transpose it into national law; companies answer to the national acts. Its practical use is as the regional floor: in markets where the national regime is still maturing, building to the Act's baseline is the defensible posture.
Which national laws descend from it?
West Africa's data-protection laws broadly trace to it, Ghana's Act 843 among the earliest, Nigeria's regime in the same lineage. That shared ancestry is why one privacy control set, properly cross-mapped, serves the region.
Why curate a regional act at all?
Because buyers and counsel ask regional questions: a pan-West-African institution wants one answer for fifteen markets. The Supplementary Act is that answer's backbone, with the national acts curated on top where they bite hardest.
Where it connects.
The full catalogCompliance you can prove.
Walk into your next audit ready.
Book a working demo. We'll map your obligations to the standards you're audited against and the regulators you actually answer to.
The platform, modules, catalog, audit trail and security architecture are live today; the continuous live-evidence engine is in active development, shown in a working demo. Reach us at hello@cardinalgrc.com.