Connect with us

E-Business

Experts Advise African Firms Processing EU Personal Data

Published

on

Kindly share this post

A piece of advice has been given to organisations in Africa processing the personal information of data subjects from within the European Union (EU).

 

At an event hosted by Baker McKenzie and Cognia Law in Johannesburg, Head of the Technology, Media and Telecommunications Practice Group at Baker McKenzie in Johannesburg, Mr Darryl Bernstein, warned organisations doing such to already have effective General Data Protection Regulation (GDPR) compliance procedures in place, including Data Breach Security Checklists, impact assessments and subject data requests procedures.

 

Mr Bernstein said this due diligence is not only required by the GDPR regulation but can significantly reduce the risks associated with security breaches, raise awareness of the GDPR and ensure that companies have appropriate technical and organisational measures in place to comply with the legislation.

 

He further said it was essential for organisations to have a General Data Protection Regulation (GDPR) Data Security Breach Checklist in place to assess the risks of a data security breach and to implement a plan to contain and manage any data breaches.

 

Mr Bernstein noted that the first step on any organisation’s GDPR Data Security Breach Checklist should be to assess the risks associated with a data security breach.

 

“It is essential to know whose data might have been disclosed, what type of data has been breached and if it contains sensitive information.

 

“Affected organisations should also asses the volume of data disclosed and if any of the data has been lost or damaged. The cause of the breach and where in the world the breach occurred must also be investigated,” he said.

 

Mr Bernstein explained that step two on the Checklist should be to contain the breach and recover the data.

 

“Organisations who have fallen victim to a data breach must establish who will investigate the breach, who will assist with the containment of the breach and/or the recovery of information and if action should also be taken to prevent the breach from recurring. This is also the time to inform the police, if appropriate to do so,” the data expert said.

 

During step three, organisations must notify all data subjects who have had their private information breached.

 

“According to the GDPR, notification must take place without undue delay and no later than 72 hours after the breach has occurred. The nature and scope of the breach, as well as its consequences and the measures taken to rectify it, must also be disclosed to affected data subjects,” he said.

 

Mr Bernstein explained that South African organisations will have to have a similar checklist in place in order to comply to the soon to be implemented Protection of Personal Information Act (POPIA).

 

POPIA stipulates that a data breach must be notified as soon as reasonably possible after the discovery of the compromise, considering the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of the responsible party’s information system.

 

To assist organisations in the event of a data breach, Baker McKenzie recently launched a mobile application called “Data Breach 72”. This app, which is available in English and French, allows organisations to identify the existence of a data breach, within the scope of application of the GDPR; establish whether it is necessary to notify the competent supervisory body; and prepare an initial draft of this notification. The app forms part of Baker McKenzie’s innovation programme, which aims to rethink the way in which lawyers deal with the challenges their clients are facing.

 

The final step in Checklist includes a thorough evaluation of the breach. “Once the first three steps are complete, organisations must investigate whether employees were responsible for the breach and if disciplinary action is required. If a third party was involved, the contract should be checked for damages provisions and an impact assessment undertaken. Lastly, organisations must review their procedures and ensure their data is secure going forward,” he said.

 

Also, partner in Baker McKenzie’s Corporate/M&A practice and TMT specialist, Janet MacKenzie, noted that, “The GDPR further requires organisations to complete a Data Protection Impact Assessment prior to the processing of private information, where the processing is likely to result in a high risk to the rights and freedoms of natural persons.

 

MacKenzie said it is essential to conduct an Impact Assessment of third parties that process high-risk company personal data, to determine their awareness of GDPR and to ensure that they have appropriate technical and organisational measures in place to comply with the legislation.

 

For high-risk third parties, audit partners should be identified for the assessment of processes and to determine if on-site audits are required. It is worth noting that the requirements of the GDPR stipulate that data processing can only be outsourced to a third party if the processor guarantees conformity with the requirements of the GDPR.

 

Janet Taylor Hall, CEO of Cognia Law, explained further, “There were two operational areas where clients tend to underestimate the impact assessment efforts around GDPR –  the first being adequately preparing to deal with a data breach when it happens and the second is subject data requests, which can in themselves lead to a breach if not handled appropriately.”

 

“Right of access is a core principle of the GDPR. Individuals have the right to access their personal data and supplementary information at any time. In responding to these data requests in time (30 days), it is also important that no data is shared that belongs to another individual or that contains intellectual property or trade secrets,” she said.

 

“Putting a robust subject data request capability in place is an important part of the on-going GDPR compliance support we offer our clients”, highlighted Justin Ridl, Global Head of Legal Services, Cognia Law.

 

 

 

 

 


Kindly share this post

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Advertisement
Comments

E-Business

Jumia Expands Nationwide Footprint, Deepens Reach Across Underserved Nigerian Cities

Published

on

Kindly share this post

e-commerce company, Jumia Nigeria, has announced a significant expansion of its logistics and pickup network across Nigeria, extending its reach into underserved regions and strengthening access to e-commerce services for millions of consumers.

The expansion, executed during the first quarter of 2026, marks a deliberate shift toward upcountry growth, with new and expanded operations across Northern Nigeria, including Kebbi, Sokoto, and Kaduna, while also strengthening presence in strategic cities like Zaria. The move is designed to close long-standing coverage gaps in high-potential areas and bring its services closer to more customers.

According to the company, the expansion reflects a convergence of customer demand, infrastructure strategy, and long-term market development, as more Nigerians outside major urban centres seek reliable access to digital retail.

“We are seeing a structural shift in where demand is coming from. What this expansion does is align our infrastructure with that reality. By extending our network deeper into the country, we are not only improving service delivery, but we are also unlocking new demand, enabling more sellers to participate in the digital economy, and building a more inclusive retail ecosystem that reflects the true scale of the Nigerian market,” said Temidayo Ojo, CEO of Jumia Nigeria.

The rollout includes a significant increase in pickup stations and delivery touchpoints across both established and emerging cities. Existing urban centres such as Lagos, Ibadan, Abuja and Port Harcourt have seen network density increase, while new and previously underserved locations are being integrated into Jumia’s logistics grid. This broader footprint is supported by investments towards parcel distribution centres, designed to decentralise inventory flow, reduce delivery time, and optimise operating costs across regions.

As part of the expansion, Jumia has also strengthened its logistics partnerships and delivery capacity, enabling more efficient last-mile fulfilment while creating income opportunities for a growing network of logistics partners and JForce agents. The company notes that these investments are critical to sustaining scale as order volumes increase across a more geographically diverse customer base.

Looking ahead, Jumia plans to extend its expansion into the South-East and South-South regions ahead of the peak retail season, further increasing its national coverage and reinforcing its position as a leading e-commerce platform in Nigeria.


Kindly share this post
Continue Reading

E-Business

RHUCE Taps Into Africa’s $3Bn Creator Economy with New Monetisation Platform

Published

on

Kindly share this post

RHUCE, a new social platform designed for African creatives, has officially launched today, introducing a new model for how creators across the continent can turn their skills, learning, and content into income.

RHUCE Taps Into Africa’s $3B Creator Economy with New Monetisation Platform

RHUCE

As Africa’s creator economy, estimated at over $3 billion, continues to grow, millions of young people are building digital skills but struggle to convert them into sustainable opportunities. RHUCE aims to bridge this gap by combining professional identity, creator monetisation, and opportunity discovery in a single ecosystem.

“Across Africa, talent is everywhere, but opportunity is fragmented,” said Simeon Ifeoluwa Adeyanju, CEO of RHUCE Limited. “Creators are learning, building, and sharing their work, but they lack a structured way to turn that into visibility, credibility, and income.”

Unlike traditional platforms that prioritise virality or finished work, RHUCE enables users to document their growth in real time, transforming their learning journey into a living portfolio.

“We believe your journey is your greatest asset,” Adeyanju said. “On RHUCE, your growth becomes your portfolio, your consistency builds your credibility, and opportunities can discover you based on what you’re becoming, not just what you’ve done.”

The platform introduces a shift from application-based hiring to discovery-driven opportunities, where creators are matched with jobs, gigs, and collaborations based on their evolving skills and documented progress.

“Instead of chasing opportunities across WhatsApp groups, DMs, and multiple platforms, we’ve built a system where you can post once and be discovered continuously,” he added.

RHUCE also provides monetisation tools that allow creators to earn through digital products, paid learning content, and brand-sponsored campaigns, unlocking new income streams within Africa’s fast-growing digital economy.

With over 60% of Africa’s population under 25, the platform positions itself as infrastructure for the continent’s next generation of talent.

“RHUCE is not just a platform for finished professionals,” Adeyanju said. “It is for people becoming something. Our goal is simple: help Africans turn learning into opportunity, and opportunity into income.”


Kindly share this post
Continue Reading

E-Business

Kaspersky Warns of Digital Medicine Risks on the Occasion of World Health Day

Published

on

Kindly share this post

On World Health Day, Kaspersky warns of risks tied to the digitisation of healthcare and use of telemedicine. Recent incidents show that medical services can be breached, and as a result, medical records may be leaked and then traded on the dark web.

The operations of healthcare services can get disrupted. Another aspect is that healthcare platforms may share user data with third parties that handle it irresponsibly.

Telemedicine has moved from a convenience to a core part of healthcare delivery, but its security model has not kept pace with its adoption, and the risks are not theoretical. Recent incidents highlight how real these risks have become.

In 2023, it was disclosed that Cerebral, a major telehealth provider focused on mental health services, had been sharing sensitive patient data – including mental health assessments, intake information, and personal identifiers – with third-party platforms such as social media and advertising networks. Millions of users were affected over several years.

More broadly, incidents in 2025 illustrate a different but equally critical risk – large-scale disruption of digital healthcare infrastructure. The breach of the ManageMyHealth patient portal exposed sensitive medical records of more than 120,000 patients, while the attack on SimonMed Imaging compromised over a million records and led to ransomware demands. These cases show that both telemedicine platforms and the broader digital healthcare ecosystems are increasingly targeted by attackers.

In parallel, scam campaigns focusing on medical topics are evolving, inviting patients for check-ups or follow-up consultations. Often the domains of the alleged “medical services” websites were created just a few weeks ago, links to the social media accounts on their pages are not working, and the Terms of Use and Privacy Policy pages are absent.

At the same time, these pages request users’ personal information, including photos of documents and even photos of parts of the body that need medical attention. Such websites often try to convince users with branding, fake doctor profiles, and urgent calls to action.

Users risk submitting sensitive personal data that can be either sold on the dark web, be used for identity theft, or subsequently used in more sophisticated attacks in the future that are targeted specifically at them for further data extortion.

To safeguard sensitive data, use a reliable security solution with an AI-powered anti-phishing component which prevents clicking on malicious links.

“The digital healthcare experience is transforming access to care, but it is also expanding the attack surface in ways many users underestimate. Medical data is highly valuable and actively traded on the dark web, making patients a prime target for fraud and targeted phishing.

“At the same time, health-related scams exploit urgency and trust, using fake consultations or discounted offers to trick users into sharing sensitive information. Patients should approach digital healthcare with the same caution as financial services – verifying providers, avoiding unsolicited links, and understanding how their data is used. Security and privacy must become a core part of the digital healthcare experience,” comments Anna Larkina, Web Content and Privacy Analysis Expert at Kaspersky.


Kindly share this post
Continue Reading

Trending