Rules on patient data differ sharply between Kenya, Nigeria, South Africa and Ghana, and Kenya has gone furthest in writing them into health-specific law. Kenya treats health data as "a strategic national asset"; Nigeria asks for filed impact assessments and approved transfer instruments; South Africa makes health data a special category with its own transfer test; Ghana's current Act is silent on transfers, while a draft bill would change that.
This is general information drawn from the named regulators and statutes. It is not legal advice, and several of these texts were moving in 2025 and 2026.
Key takeaways
- Kenya has the most specific health-data rules: certification of digital health solutions, a ban on sharing personal health information abroad except for health tourism, and a data-protection rule requiring a Kenyan copy for processing in the state's strategic interest.
- Nigeria requires a filed data protection impact assessment for health-care processing and cross-border transfers, and an adequacy decision or approved instrument for transfers.
- South Africa sets health data as special personal information (POPIA s26), with a separate transfer test (s72) and a confidentiality duty in the National Health Act (s14).
- Ghana's 2012 Act has no explicit transfer regime. A 2025 draft bill on the regulator's site would localise health records by default.
- Africa CDC's member states validated a continental health data governance framework on 22 October 2026. It is not yet law.
The buyer's problem. You are a hospital group, an insurer or a digital-health buyer, and the partner stores or analyses patient data. Three questions come first. Where does the data sit? Who may see it, and under which legal ground? What happens when it leaves the country?
Peer-reviewed work frames the same worry. A 2019 paper in BMJ Global Health by Tiffin, George and LeFevre argues that digital health data are easy to copy and hard to recall, and proposes four governance domains: ethical oversight and consent, access controls, sustainability, and legal compliance. Its South African case study found that consent could not be confirmed for about half of registrants in a national maternal messaging programme, because registration often happened on someone else's phone. The paper also notes that cross-border transfer of identifiable health data requires specific permission from the South African regulator. That is a 2019 statement, so check against the current text below.
Four countries side by side
| Country | Core health-data hook | Cross-border position | Localisation | |---|---|---|---| | Kenya | Digital Health Act 2023; Digital Health (Health Information Management Procedures) Regulations 2025 | s47: personal health information may only be shared outside Kenya for health tourism; s46 safeguards for medical records leaving | Data Protection (General) Regulations 2021, reg 26: Kenyan server or at least one serving copy for processing in the state's strategic interest, including primary or secondary health care | | Nigeria | NDPA 2023, GAID 2025 | Adequacy decision, approved cross-border data transfer instrument, or other lawful basis in Part VIII | No health-specific rule found in the GAID | | South Africa | POPIA ss26, 32, 72; National Health Act s14 | s72: adequate protection in recipient law or agreement, consent, or a listed necessity ground | No general localisation rule in POPIA | | Ghana | Data Protection Act 2012, s37 | No explicit transfer regime found in the Act | Draft Data Protection Bill 2025 proposed localisation duties; in March 2026 the Communications Minister said a new bill is being developed |
The Nigerian NDPA text itself was not read, only the Commission's GAID that implements it. Neither the Kenyan Data Protection Act 2019 nor the Kenya Health Act was read; the Kenyan rules below come from the Digital Health Act, its regulations and the ODPC's published general regulations.
Kenya: certification plus a sharing ban
The Digital Health Act 2023 opens with a principle: "health data is a strategic national asset" (s4). The Digital Health Agency will "certify digital health solutions based on best practices and standards" (s6(m)). Section 47 says personal health information "may only be shared to any person outside Kenya for the purposes of health tourism", which the Act defines as a patient travelling across borders for treatment. Unauthorised sharing, tampering, loss or theft of health data is an offence with a fine up to KES 1,000,000 or up to 15 years in prison, or both (s35).
The 2025 regulations (Legal Notice 76, commenced 11 April 2025) add the machinery. Providers need a certificate of compliance, which has to be renewed after a set period (check the regulations for the exact term). Providers must meet information security and privacy standards under the Kenya Health Data Governance Framework and interoperability capability under the Interoperability Framework. Providers already operating were given a transition window to apply.
Hosting is a separate instrument. Regulation 26 of the Data Protection (General) Regulations 2021 says processing for the "strategic interest of the state" must run through a server and data centre in Kenya, or keep at least one serving copy in a Kenyan data centre. Its list includes "provision of primary or secondary health care for a data subject in the country".
Our reading: for a hospital buying a platform, the question is not whether the vendor is "GDPR compliant". Ask for its Kenyan certificate of compliance and its hosting arrangement.
Nigeria: paperwork before transfer
The Nigeria Data Protection Commission's GAID 2025 makes a data protection impact assessment mandatory, and filed with the Commission, in listed circumstances that include sensitive data, health care services and cross-border transfer. For transfers, Article 45 and Schedule 5 point to an adequacy decision, a Commission-approved cross-border data transfer instrument, or other lawful bases under Part VIII of the Act. A controller domiciled abroad is not exempt where the data subject is in Nigeria.
No health-specific localisation rule appears in the Directive. If a partner says there is one, ask for the citation.
South Africa: special information and a confidentiality duty
POPIA section 26 prohibits processing health information unless an authorisation applies. Section 32 lets medical professionals and institutions process it where "necessary for the proper treatment and care", and lets insurers and medical schemes process it for assessing risk, performing the agreement or enforcing contractual rights. That distinction matters for insurers: the permission is narrower than "any analytics".
Transfers abroad are governed by section 72. The responsible party may not transfer to a third party in a foreign country unless the recipient is subject to a law, binding corporate rules or agreement giving adequate protection, or the data subject consents, or one of the contract or benefit grounds applies. The Information Regulator's FAQ adds that prior authorisation applies where special personal information is transferred to a third party in a country without adequate protection. It also says all security compromises must be reported "irrespective of the deemed level of risk", through the eServices Portal since 1 April 2025.
The National Health Act s14 sits on top: all information about a user, including health status and treatment, is confidential and may be disclosed only with written consent, under a court order or law, or where non-disclosure is a serious public-health threat.
Ghana: an Act with a gap, and a draft
Ghana's Data Protection Act 2012 prohibits processing special personal data, including health, unless it is necessary or the subject consents (s37). Processing is presumed necessary for medical purposes by a health professional under a duty of confidentiality (s37(6)(e)). No explicit cross-border transfer regime appears in the Act.
The Data Protection Commission has posted a "Data Protection Bill, 2025" draft. Its legislative status is not confirmed and the text may change. Section 96 would set "reasonable efforts to localise" as the default and would require localisation for categories including health records, with Authority-approved transfers on data-subject consent. Treat it as a signal, not as law.
Continental and global frameworks. On 22 October 2026, Africa CDC reported that African Union Member States validated the African Continental Health Data Governance Framework in Addis Ababa. It builds on the Malabo Convention, the AU Data Policy Framework (2022) and the Digital Transformation Strategy for Africa (2020 to 2030), and proposes a federated approach to cross-border sharing in which countries keep oversight. Africa CDC will finalise it, and AU policy consideration is anticipated in 2027. Nothing in it binds your partner today.
The WHO Global Strategy on Digital Health 2020-2025 says health data should be classified as sensitive personal data requiring a high safety and security standard. The World Health Assembly extended the strategy to 2027 in May 2025 (decision WHA78(22)).
On interoperability, HL7 describes FHIR as "a standard for exchanging healthcare information electronically", where "all exchangeable content is defined as a resource". OpenHIE describes itself as a community "building an open framework to support nations as they develop health information exchanges". Kenya's regulations tie certification to an interoperability framework, so FHIR support is a contract question, not a courtesy.
The strongest counterargument. A partner may argue that local copies add cost and risk without improving privacy, since a Kenyan data centre can be breached like any other. That is a fair technical point. Localisation rules, though, are a legal obligation where they apply, and a vendor who cannot meet them can leave you exposed regardless of the engineering merits.
Buyer guidance
Ask each partner, in writing:
- Which country's law applies to each dataset, and which regulator registrations or certificates exist? Ask for Kenya's certificate of compliance where relevant.
- Where is the primary copy hosted, where are backups, and who can access them from other countries?
- What is the transfer ground for each flow: adequacy, approved instrument, consent, or a necessity ground? Ask for the section number.
- Is a data protection impact assessment filed (Nigeria) and available to you?
- Which interoperability standards does the product support, and has that been tested with a government registry or health information exchange?
- Who notifies whom within what time when there is a breach? South Africa expects notification irrespective of risk level.
- What happens to data at contract end?
Shortlisting by country and category helps before these conversations: the healthtech category, the directory, a country page such as Kenya and find-partner show who operates where. They describe providers, and do not replace the regulator texts above.
Frequently asked questions
Can a Kenyan hospital send patient data to a European analytics partner? Under the Digital Health Act s47, personal health information may only be shared outside Kenya for health tourism. Anything else needs legal advice before the first transfer.
Does Nigeria require patient data to stay in Nigeria? The GAID 2025 has no health-specific localisation rule. It does require a filed impact assessment for health-care processing and transfer grounds under Part VIII of the NDP Act.
Is the African Continental Health Data Governance Framework binding? No. Member States validated it on 22 October 2026, Africa CDC will finalise it, and AU policy consideration is anticipated in 2027.
What does FHIR change for a buyer? It gives you a published standard to name in the contract, so the partner's data can be exchanged with other systems without a custom connector.
Sources
- Digital Health Act 2023, Kenya Law
- Digital Health (Health Information Management Procedures) Regulations 2025, Kenya Law
- Data Protection (General) Regulations 2021, Office of the Data Protection Commissioner, Kenya
- GAID 2025, Nigeria Data Protection Commission
- Data Protection Act 2012 (Act 843), Data Protection Commission, Ghana
- Data Protection Bill, 2025 (draft), Data Protection Commission, Ghana
- Protection of Personal Information Act 4 of 2013, Government of South Africa
- National Health Act 61 of 2003, Government of South Africa
- POPIA guidance and FAQs, Information Regulator (South Africa)
- AU Member States validate African Continental Health Data Governance Framework, Africa CDC
- Global Strategy on Digital Health 2020-2025, World Health Organization
- FHIR overview, HL7 International
- OpenHIE, OpenHIE community
- Digital health data governance to protect vulnerable populations in LMICs, BMJ Global Health, 2019