The AWS Shared Responsibility Model
Before mapping AWS to specific African regulations, you need to know what AWS secures and what your team is responsible for. The model splits cleanly into two halves.
AWS handles
Security of the cloud
- •Physical data centres and hardware
- •Virtualisation layer and host OS
- •Managed service infrastructure
- •ISO 27001, SOC 2, PCI-DSS certifications
You handle
Security in the cloud
- •EC2 operating systems and applications
- •IAM identities and access policies
- •Network configuration and firewall rules
- •Encryption settings and key management
No AWS service encrypts your data or restricts access by default. Compliance with African data-protection regulations depends almost entirely on the choices you make within the customer-responsibility layer.
Key African Data-Protection Regulations
Three regimes cover the bulk of the African data-protection landscape: KDPA in Kenya, POPIA in South Africa, and NDPR in Nigeria. Use the table for a quick comparison, then read the deeper notes on each below.
| Dimension | KDPA (Kenya) | POPIA (South Africa) | NDPR (Nigeria) |
|---|---|---|---|
| Regulator | ODPC | Information Regulator | NITDA |
| In force from | November 2019 | July 2021 | January 2019 |
| Breach notification | Within 72 hours | Without unreasonable delay | Without delay; annual audit if > 1,000 subjects |
| Max penalty | KES 5M or 3 years | R10M or 10 years | 2% of annual gross revenue |
| Lawful basis required | Yes | Yes | Yes |
Kenya Data Protection Act (KDPA) 2019
In force from
November 2019
Regulator
ODPC
Max penalty
KES 5M or 3 yrs
Core obligations
- •Lawful basis for processing
- •Purpose limitation
- •Data minimisation
- •Accuracy
- •Storage limitation
- •Breach notification within 72 hours
South Africa Protection of Personal Information Act (POPIA) 2021
In force from
July 2021
Regulator
Information Regulator
Max penalty
R10M or 10 yrs
Broadly comparable to the EU's GDPR. Requires appointing an Information Officer and mandatory breach notification. Eight conditions for lawful processing:
- •Accountability
- •Processing limitation
- •Purpose specification
- •Further processing limitation
- •Information quality
- •Openness
- •Security safeguards
- •Data subject participation
Nigeria Data Protection Regulation (NDPR) 2019
Issued
January 2019
Regulator
NITDA
Max penalty
2% of annual revenue
Applies to Nigerian organisations and any organisation processing data of Nigerian residents. Key obligations:
- •Lawful basis for processing
- •Minimum retention periods
- •Data subject rights
- •Security measures proportionate to risk
- •Annual data-protection audit filed with NITDA if processing > 1,000 subjects
The AWS Cape Town Region for African Workloads
AWS operates the Africa (Cape Town) region (af-south-1) — the first AWS Region on the continent, with three Availability Zones in the Cape Town metropolitan area. Choosing it as your primary region gives African workloads low-latency access to a full set of AWS services without leaving the continent.
A few region-behaviour rules that matter for compliance:
- Data does not leave a region by default. S3 Cross-Region Replication, Aurora Global Database, and DynamoDB Global Tables all require explicit customer configuration to copy data elsewhere.
- Latency to Nairobi is 40–60 ms from af-south-1 — workable for most enterprise workloads.
- Use CloudFront for low-latency delivery with origin in af-south-1 for end-user-facing apps where perceived speed matters.
- Audit cross-region services explicitly. Maintain an inventory of every replication and backup target so compliance reviews can verify the data flow at a glance.
Essential AWS Compliance Controls
Meeting African data-protection obligations comes down to four foundational controls, implemented consistently across every account.
Encryption at rest
Enable encryption on every data store — S3, EBS, RDS, DynamoDB — using AWS KMS with a customer-managed key. Customer-managed keys let you disable or delete the key to render data inaccessible instantly.
Encryption in transit
Enforce TLS at every endpoint. AWS services use TLS by default, but your applications must also enforce it for inter-component traffic. Use ACM certificates and redirect HTTP to HTTPS at the load balancer.
Least-privilege IAM
Roles, not users, for applications. IAM Identity Center (SSO) for humans. Rotate access keys regularly. Secrets Manager for programmatic credentials — never embed them in code or config.
Data classification and tagging
Tag every resource with its data-sensitivity classification. This enables automated AWS Config enforcement and lets you produce cost and compliance reports broken down by classification.
Audit Logging and Monitoring
Compliance regulations require demonstrable evidence of who accessed what data, when, and from where. Three AWS services form the backbone of a compliant audit posture.
AWS
CloudTrail
Who did what, when, from where
Records every AWS API call — identity, timestamp, source IP, action, and response. Ship logs to an S3 bucket with Object Lock (WORM) in a centralised logging account that only the security team can access, so even a compromised workload account cannot tamper with the trail.
AWS
Config
Continuous configuration compliance
Records the configuration state of every AWS resource and evaluates it against rules. Managed rules cover common requirements: no public S3 buckets, EBS volumes encrypted, no unrestricted inbound SG rules. Custom Lambda rules let you encode organisation-specific policy as code.
AWS
Security Hub
One pane for findings
Aggregates findings from CloudTrail, Config, GuardDuty, and Inspector. Maps them to AWS Foundational Security Best Practices, CIS AWS Foundations Benchmark, and PCI-DSS, giving compliance teams one prioritised view of open findings.
Breach Notification and Incident Response
KDPA, POPIA, and NDPR each impose their own breach-notification windows. Missing them is a regulatory finding on top of the breach itself.
Notification windows you cannot miss
- KDPA:Within 72 hours of becoming aware of a breach involving personal data. Notify the Data Commissioner.
- POPIA:Without unreasonable delay once a breach likely to cause serious harm is discovered. Notify the Information Regulator and affected data subjects.
- NDPR:Without delay. Annual data-protection audit filed with NITDA for orgs processing > 1,000 subjects.
Detection. Amazon GuardDuty continuously monitors for malicious activity and anomalous behaviour using threat intelligence, machine learning, and anomaly detection. Findings can trigger automated remediation through EventBridge and Lambda — for example, isolating a compromised EC2 instance by modifying its security group or suspending a compromised IAM credential.
Runbooks. Prepare an incident response runbook before you need it. Your runbook should answer four questions:
- Who inside the organisation must be notified, and in what order?
- Who contacts the regulator, and what information must the notification include?
- How is forensic evidence in AWS preserved (snapshots, log exports, IAM history)?
- How is the affected data subject communication drafted and approved?
The AWS Security Incident Response Guide ships a set of playbooks you can adapt directly to your regulatory obligations.
Frequently Asked Questions
No. The AWS Shared Responsibility Model means AWS secures the underlying infrastructure, but you are responsible for securing the data and applications you run on top of it. Selecting the correct AWS Region, implementing access controls, encrypting data at rest and in transit, configuring audit logging, and establishing breach-notification processes are all customer responsibilities that determine whether your workload is compliant with local regulations.
Kenya's Data Protection Act does not impose an absolute data-localisation requirement. Legal advice specific to your use case and data categories is always recommended before finalising your architecture.
AWS CloudTrail records every API call made in your account with full metadata, providing an immutable audit log. AWS Config continuously records resource configuration changes and alerts on non-compliant configurations. AWS Security Hub aggregates findings from multiple security services and maps them to compliance frameworks including CIS, PCI-DSS, and ISO 27001. AWS Artifact provides downloadable compliance reports and certifications for use in your own audit evidence packages.
AWS launched the Africa (Cape Town) region, designated af-south-1, in April 2020. It is the first AWS Region on the African continent and covers three Availability Zones. The region supports the majority of core AWS services including EC2, RDS, S3, Lambda, VPC, IAM, CloudWatch, EKS, and Direct Connect. It provides the lowest latency to users across East and Southern Africa.
