Mobile Virtual Network Operators (MVNOs) are transforming connectivity across Africa by unlocking new markets, bridging coverage gaps, and driving competition without the capital intensity of traditional network ownership. Yet, this very structure introduces one of the continent\u2019s most pressing governance challenges: how to manage privacy and data protection when the customer relationship and the physical network belong to different entities.<\/p>\n
In markets where digital trust is fast becoming the currency of competitiveness, privacy is no longer a compliance checklist. For the modern MVNO, it is infrastructure\u2014a structural condition for market entry, investment, and longevity.<\/p>\n
Every MVNO operates in a complex ecosystem where data ownership<\/strong> and technical control<\/strong> are split.<\/p>\n This creates a form of dual custodianship<\/strong>, where subscriber information\u2014from call records to location data\u2014flows continuously between parties. Without clearly defined governance and contractual boundaries, these flows risk contravening local and international privacy regimes.<\/p>\n In Africa, where regulators are tightening enforcement and cross-border data transfers are increasingly scrutinised, MVNOs must integrate privacy as a strategic and operational discipline<\/strong> from inception.<\/p>\n<\/blockquote>\n The EU GDPR<\/strong> remains the international benchmark for lawful processing, consent, and accountability. It applies extraterritorially, meaning any MVNO serving or monitoring EU data subjects must comply.<\/p>\n The GDPR defines data-processing roles explicitly:<\/p>\n The risk of misclassification is significant. Joint controllers share liability for non-compliance, and penalties can reach up to \u20ac20 million or 4% of global turnover<\/strong>.<\/p>\n<\/blockquote>\n South Africa\u2019s POPIA <\/b><\/a>operationalises GDPR-like principles\u2014lawfulness, minimality, and accountability<\/em>\u2014within a uniquely African legal context.<\/p>\n For MVNOs, POPIA introduces obligations such as:<\/p>\n Where MNOs and MVNOs jointly determine processing, a joint-responsibility agreement<\/strong> under section 72 (cross-border transfers) and section 21 (operators\u2019 obligations) becomes essential. This agreement must explicitly allocate accountability, define breach procedures, and establish how data subjects\u2019 rights will be honoured.<\/p>\n<\/blockquote>\n Nigeria\u2019s Nigeria Data Protection Regulation (NDPR)<\/strong>, issued by NITDA<\/a>, requires that all data controllers and processors handling Nigerian data subjects\u2019 information register with the Nigeria Data Protection Commission (NDPC)<\/strong><\/a> and submit annual audit reports.<\/p>\n MVNOs operating in Nigeria must:<\/p>\n Because many Nigerian MVNOs rely on regional MNOs or cloud-hosted MVNEs, compliance often extends to infrastructure transparency<\/strong>,\u00a0ensuring data centres and API endpoints are either in Nigeria or located in jurisdictions with \u201cadequate\u201d protection.<\/p>\n<\/blockquote>\n Kenya\u2019s Data Protection Act, 2019<\/strong> mirrors GDPR principles while adding sectoral nuance through the Office of the Data Protection Commissioner (ODPC)<\/strong><\/a>.<\/p>\n\n
\n
Regulatory landscape<\/h2>\n
GDPR and its global influence<\/h3>\n
\n
\n
South Africa\u2019s POPIA<\/h3>\n
\n
\n
Nigeria\u2019s NDPR: compliance through localisation<\/h3>\n
\n
\n
Kenya\u2019s Data Protection Act (DPA): lawful processing in telecoms<\/h3>\n