Data Localisation, National Security and Public Interest in Cross-Border Data Transfers: Convergence or Divergence in Kenya and Rwanda?

Ezekiel, Rindstone Bilabamu (2026) Data Localisation, National Security and Public Interest in Cross-Border Data Transfers: Convergence or Divergence in Kenya and Rwanda? East African Journal of Law and Ethics, 9 (3). 516-537p.. ISSN 2707-5338

PDF - Published Version Available under License Creative Commons Attribution. Download (437kB)

Abstract

This article examines how principles of necessity, proportionality, and regulatory discretion are operationalised in cross-border data transfer regimes in Kenya and Rwanda, with specific focus on national security and data localisation considerations. Despite formal convergence in adopting adequacy-based transfer frameworks, significant variation persists in how these principles are embedded and applied in practice, shaping divergent regulatory outcomes in cross-border data governance. The study addresses the research question: To what extent do Kenya and Rwanda operationalise necessity, proportionality, and discretion in regulating cross-border data transfers through national security and data localisation provisions, and what do these differences reveal about convergence in African data protection regimes? The objectives are to (i) identify the legal bases governing cross-border data transfers in both jurisdictions, (ii) analyse how national security and public interest considerations are structured within these regimes, and (iii) assess the extent to which regulatory discretion produces convergence or divergence in practice. Methodologically, the article adopts a comparative doctrinal legal analysis, focusing on statutory interpretation of Kenya’s Data Protection Act 2019 and Rwanda’s Law No. 058/2021 on the Protection of Personal Data and Privacy, supplemented by relevant subsidiary regulations. It applies a principles-based evaluation to assess how necessity, proportionality, and discretion are embedded in transfer authorisation and restriction mechanisms. The findings indicate formal convergence in adequacy based transfer rules but substantive divergence in regulatory architecture: Kenya relies on ex post, enforcement-driven discretion with broad public interest overrides, while Rwanda employs an ex-ante, structured authorisation model incorporating statutory localisation tendencies. The study concludes that convergence remains partial and fragmented, driven more by shared normative frameworks than uniform regulatory execution. It recommends clearer statutory articulation of proportionality standards and more transparent criteria for national security-based transfer restrictions to enhance legal certainty and regional coherence.

Actions (login required)

View Item