Compare jurisdictions

Side-by-side view of the obligations each covered law imposes, grouped by category. Use this to spot where requirements overlap (one well-written control often satisfies multiple jurisdictions).

Category	🇪🇺European Union / EEA European Data Protection Board (and national DPAs)	🇬🇭Ghana Data Protection Commission, Ghana	🇰🇪Kenya Office of the Data Protection Commissioner	🇳🇬Nigeria Nigeria Data Protection Commission	🇺🇸United States (California) California Privacy Protection Agency
Governance & Accountability	GDPR-Art-37 Appoint a Data Protection Officer (DPO) where required A DPO is required for public authorities, large-scale monitoring, or large-scale special-category data processing. GDPR · Arts. 37-39 GDPR-Art-5 Adhere to the principles of processing Lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality, accountability. GDPR · Art. 5	GH-Principles Apply the eight data protection principles Accountability, lawfulness, specification of purpose, compatibility of further processing, quality, openness, safeguards, data subject participation. Ghana DPA 2012 · Act 843 §17	KE-Principles Apply data protection principles Lawfulness, purpose limitation, minimisation, accuracy, storage limitation, integrity/confidentiality. Kenya DPA 2019 · DPA §25	NG-DPO Appoint a Data Protection Officer where required Controllers of major importance and processors of high-risk data must appoint a DPO and publish their contact. Nigeria NDPA 2023 · NDPA §32 NG-Principles Observe principles of personal data processing Lawfulness, fairness, transparency, purpose specification, accuracy, storage limitation, integrity and confidentiality, accountability. Nigeria NDPA 2023 · NDPA §24	—
Lawful basis & consent	GDPR-Art-6 Establish a lawful basis for each processing activity Identify and document one of the six lawful bases for every processing activity (consent, contract, legal obligation, vital interests, public task, legitimate interests). GDPR · Art. 6	GH-Consent Obtain consent or rely on a lawful processing ground Processing requires consent or another lawful ground (contract, legal obligation, vital interests, public interest, legitimate interests). Ghana DPA 2012 · Act 843 §20	KE-Consent Establish a lawful basis One of: consent, contract, legal obligation, vital interests, public task, legitimate interests. Kenya DPA 2019 · DPA §30	NG-Lawful Establish a lawful basis One of: consent, contract, legal obligation, vital interests, public interest, legitimate interests. Nigeria NDPA 2023 · NDPA §25	—
Transparency & notices	GDPR-Art-12 Provide transparent information to data subjects Provide a concise, intelligible privacy notice covering identity of controller, purposes, legal basis, recipients, retention, rights, and contact for the DPO. GDPR · Arts. 12-14	GH-Notice Provide notice to data subjects at collection Inform subjects of the purposes, recipients, rights, consequences of refusal, and contact for the controller. Ghana DPA 2012 · Act 843 §24	KE-Notice Provide information to data subjects Notify subjects of rights, purposes, recipients, retention, and contacts. Kenya DPA 2019 · DPA §29	NG-Notice Provide privacy information to data subjects Notify subjects of identity, purposes, recipients, retention, rights, and NDPC complaint channel. Nigeria NDPA 2023 · NDPA §27	CCPA-Notice Provide notice at or before collection Inform California consumers of categories collected, purposes, retention, and rights. CCPA/CPRA · Cal. Civ. Code §1798.100
Data subject rights	GDPR-Art-15 Honor data subject rights within one month Access, rectification, erasure, restriction, portability, objection, and opt-out of automated decisions must be processed within one calendar month (extendable by two months for complexity). GDPR · Arts. 15-22	GH-Rights Facilitate data subject rights of access and correction Data subjects may access their data, request correction, and object to processing. Ghana DPA 2012 · Act 843 §§32-37	KE-Rights Respect data subject rights Access, rectification, erasure, restriction, portability, objection to automated decision-making. Kenya DPA 2019 · DPA §26, §40	NG-Rights Honour data subject rights Access, rectification, erasure, restriction, portability, objection, opt-out of automated decisions. Nigeria NDPA 2023 · NDPA §§34-39	CCPA-OptOut Provide a "Do Not Sell or Share My Personal Information" link Businesses must provide a clear, conspicuous Do-Not-Sell/Share link and honor Global Privacy Control signals. CCPA/CPRA · §1798.135 CCPA-Rights Honor consumer rights to know, delete, correct, and limit Within 45 days (extendable by 45): access, deletion, correction, and limit use of sensitive personal information. CCPA/CPRA · §1798.105-.125
Security of processing	GDPR-Art-32 Implement appropriate technical and organisational measures (TOMs) Encryption, pseudonymisation, availability/integrity, regular testing, and ability to restore availability. GDPR · Art. 32	GH-Security Safeguard data against loss and unauthorised access Reasonable technical and organisational measures to preserve integrity and confidentiality of personal data. Ghana DPA 2012 · Act 843 §28	—	NG-Security Implement appropriate technical and organisational measures Protect against unauthorised access, loss, destruction, alteration, or disclosure. Nigeria NDPA 2023 · NDPA §39	CCPA-Security Implement reasonable security procedures Protect personal information from unauthorised access, destruction, use, modification, or disclosure. CCPA/CPRA · §1798.100(e)
Breach notification	GDPR-Art-33 Breach notification within 72 hours Personal data breaches must be notified to the supervisory authority within 72 hours of becoming aware, and affected data subjects notified if high risk. GDPR · Arts. 33-34	—	KE-Breach Notify the ODPC of breaches within 72 hours Controllers must notify the ODPC within 72 hours of becoming aware; data subjects where there is real risk of harm. Kenya DPA 2019 · DPA §43	NG-Breach Notify the NDPC of breaches within 72 hours Notify the NDPC within 72 hours of becoming aware; data subjects where there is real risk of harm. Nigeria NDPA 2023 · NDPA §40	—
International transfers	GDPR-Chap-V Use a valid transfer mechanism for data leaving the EEA Transfers outside the EEA require an adequacy decision, SCCs, BCRs, or a valid derogation; complete a Transfer Impact Assessment where applicable. GDPR · Arts. 44-50	GH-Transfers Ensure lawful cross-border transfers Transfers to countries without an adequate regime require safeguards or consent. Ghana DPA 2012 · Act 843 §47	KE-Transfers Ensure lawful cross-border transfers Transfers out of Kenya require adequacy, appropriate safeguards, or an applicable exemption. Kenya DPA 2019 · DPA §§48-50	NG-Transfers Ensure lawful cross-border transfers Transfers permitted on basis of adequacy, appropriate safeguards, binding instruments, or exceptions. Nigeria NDPA 2023 · NDPA §§41-43	—
DPIA / Risk assessment	GDPR-Art-35 Perform DPIA for high-risk processing A Data Protection Impact Assessment is mandatory for processing likely to result in high risk to rights and freedoms (profiling, large-scale special category, children's data, public monitoring). GDPR · Art. 35	—	KE-DPIA Complete DPIA for high-risk processing DPIAs required for processing likely to result in high risk to rights and freedoms. Kenya DPA 2019 · DPA §31	—	—
Processors & sub-processors	—	—	—	—	CCPA-Contracts Flow-down contractual terms to service providers and contractors Written contracts with required clauses (purpose limitation, no sale, audit rights). CCPA/CPRA · §1798.100(d)
Record of processing	GDPR-Art-30 Maintain Records of Processing Activities (ROPA) Controllers and processors must maintain a written register of processing activities listing purposes, categories of data and subjects, recipients, transfers, retention, and security measures. GDPR · Art. 30	—	—	NG-ROPA Maintain records of processing activities Controllers and processors of major importance must maintain written processing records. Nigeria NDPA 2023 · NDPA §29	—
Special categories / children	—	—	—	—	CCPA-Sensitive Provide "Limit Use" for Sensitive Personal Information Consumers may direct businesses to limit use of sensitive PI to what is necessary to perform services. CCPA/CPRA · §1798.121
Regulator registration	—	GH-Registration Register as a data controller with the Data Protection Commission All data controllers processing personal data in Ghana must register with the DPC and renew annually. Ghana DPA 2012 · Act 843 §§27-29	KE-Registration Register as data controller or processor with the ODPC Controllers and processors above a prescribed threshold must register with the ODPC (renewable every 2 years). Kenya DPA 2019 · DPA §18	—	—

Each obligation links to the official law text or the regulator that imposes it, with the precise article/section shown beside it. Sourced from the same content engine that powers the assessment. Cells marked "—" mean the law in that column has no specific requirement in that category — not that anything is exempt. Each framework's last-reviewed date, source version and change history are on the methodology page.