Cybersecurity Regulation in Africa: From Fragmentation to Harmonisation

Across Africa's 55 countries, the cybersecurity regulatory landscape presents a stark picture of fragmentation. As of 2024, fewer than 30 countries have comprehensive cybersecurity laws; of those, fewer than 15 have operational CERTs; and cross-border cyber incident coordination among African states remains largely ad hoc. Meanwhile, cybercrime is estimated to cost African economies approximately $4 billion annually — a figure that grows every year as digital dependence deepens.

This fragmentation is not merely an inconvenience — it is a strategic vulnerability. Cyber threats are inherently cross-border, exploiting the gaps between national jurisdictions to evade detection, attribution, and response. The more fragmented Africa's regulatory landscape, the more attractive the continent's digital infrastructure becomes as a target and as a transit point for global cybercriminal operations.

The State of Continental Harmonisation

The African Union has made significant progress on the harmonisation agenda. The Malabo Convention on Cyber Security and Personal Data Protection — adopted in 2014 and entered into force in 2023 after reaching the required 15 ratifications — provides the continental legal foundation. The AU Cybersecurity Framework, developed in partnership with member states and technical partners, provides implementation guidance. And the Africa Digital Compact includes specific cybersecurity commitments for member states.

Progress, however, has been uneven. Many countries that have enacted cybersecurity laws have done so independently of the continental frameworks — creating a second layer of harmonisation challenge as existing laws need to be aligned with continental standards.

The Key Harmonisation Challenges

Three challenges stand out in the harmonisation process. First, jurisdictional diversity: African states inherit radically different legal traditions (common law, civil law, customary law, Islamic law) that shape how cybersecurity laws are structured. Harmonisation must accommodate this diversity rather than imposing a one-size-fits-all model. Second, capacity gaps: even where harmonised standards exist, many states lack the regulatory capacity — skilled personnel, technical infrastructure, institutional authority — to implement them effectively. Third, political economy: cybersecurity regulation creates both costs (compliance burdens) and benefits (security) unevenly distributed across stakeholders, generating political resistance that slows adoption.

A Way Forward

The path to effective continental cybersecurity harmonisation runs through four areas: investing in CERT capacity at the national level (a pre-condition for meaningful cross-border cooperation); operationalising the AU's cross-border incident response protocol; developing a mutual legal assistance treaty (MLAT) mechanism for cybercrime that works across Africa's diverse legal systems; and building the technical communities of practice that enable practitioners across the continent to share threat intelligence and response experience in real time.