The regulators stopped being theoretical. Kenya's data commissioner has been issuing penalties since 2023, Uganda's office found Google in breach and ordered it to register locally in 2025, and Zambia's commissioner opened enforcement with a hard deadline. Where your server physically sits is now something a regulator can ask about, and "somewhere in the cloud" is not an answer that holds.
At CloudSpinx we provision and manage servers for clients across East Africa and a range of sectors, and this data-residency question comes up on almost every regulated workload we touch. Here is the plain-language version of what the four main laws require about where data can live.
Checked against the four Acts in July 2026. This is orientation, not legal advice, so confirm your own position with counsel.
| Country | Law | Must data stay in-country? | Hosting abroad is allowed if |
|---|---|---|---|
| Kenya | Data Protection Act, 2019 | Only specific state-interest categories | You have appropriate safeguards; sensitive data also needs consent |
| Tanzania | Personal Data Protection Act, 2022 | No | You get a prior transfer permit from the regulator |
| Uganda | Data Protection and Privacy Act, 2019 | No | The destination has equivalent protection, or the person consented |
| Zambia | Data Protection Act, 2021 | Yes, and sensitive data always | Only for carved-out ordinary data, with consent and approved contracts |
Zambia is the one that catches people
Most of the region lets you host abroad if you do the paperwork. Zambia does not. Section 70 of its Data Protection Act says personal data is stored in-country by default, and sensitive data, which covers health, biometric, financial and more, must always stay in Zambia with no exception. So a Zambian business holding customer records cannot legally put them in Johannesburg or Frankfurt, however good the price or the latency looks. If you operate in Lusaka, that decides the hosting location before anything else does.
One thing to clear up: people sometimes cite Zambia's Electronic Communications and Transactions Act as a second localization rule. It is not. The storage requirement lives entirely in the Data Protection Act.
Kenya, Tanzania and Uganda gate the exit, not the location
The other three let data leave, on conditions. Kenya only forces specific state-interest categories to keep a copy in-country, things like civil registration, elections, public finance and basic health and education records. Everything else can go abroad with appropriate safeguards, and sensitive data needs consent on top. The fine is capped at KES 5 million or 1 percent of turnover, whichever is lower.
Tanzania takes no localization stance but makes you get a permit from its commission before personal data leaves the country, so the transfer is a step you complete beforehand, not something an auditor finds later. Uganda is the simplest of the three: you may host abroad if the destination protects data at least as well as Uganda's law does, or if the person consented. Consent alone is a valid basis, which is why Uganda rarely blocks a well-run transfer.
The gap nobody mentions in the sales call
Here is the fact that turns all of this from paperwork into an architecture decision. None of AWS, Microsoft Azure or Google Cloud runs a live region physically inside Kenya, Tanzania, Uganda or Zambia. The only hyperscaler regions on the continent are in South Africa. AWS announced a Nairobi region for late 2026 and Microsoft's Kenya plan has stalled, but today neither exists.
So when Zambian law says the data stays in Zambia, clicking "africa-south1" in a cloud console does not satisfy it, because that region is in Johannesburg. Genuine in-country residency right now means local colocation or a dedicated server placed in a datacentre in that country. That is the practical reason regulated workloads keep landing on dedicated hardware rather than public cloud.
How to decide
Work it in this order. Whose data is it, and which country do those people live in, because that is the law that binds you. Is any of it sensitive, since that is where every one of these laws tightens and where Zambia closes the door entirely. If you can host abroad, can you actually complete the step the law asks for. Only once that is settled do latency and cost get a vote, and for East African users a regional server usually wins both, which we cover in where to host your servers.
If you are not sure which bucket your workload falls into, send us the shape of the data through the quote form or on WhatsApp at +254 719 246 379. We will tell you where it can legally and quickly live, no charge for the answer, before you commit to anything.
The controls that sit on top of residency, the hardening and monitoring a regulator will ask about, are our cybersecurity team's job.