Laws by country

This is not legal advice; confirm with counsel

This page summarises how SpeculaPro’s data protection features map to each law. It was checked against the primary texts in October 2026 unless marked otherwise, but laws change and interpretations differ. Your institution remains responsible for its own compliance. Confirm every period, deadline and exemption with your legal adviser before relying on it, and read the open legal points below.

How SpeculaPro uses these laws

Each workspace has a main jurisdiction and optionally other laws that apply (set in Registers → Settings). From them, SpeculaPro takes:

• the retention minimum for AML records: the longest among the laws that apply;
• the deadline for each data subject request, from the law chosen for that request;
• the breach notifications each law requires, and their deadlines;
• the erasure exemption recorded when AML record keeping postpones an erasure.

A country not in the tables below gets the baseline: the FATF five-year minimum, a 30-day request deadline, and “check the national law” for breaches.

How confident we are in each figure: checked against the primary text; secondary from a reliable secondary source; established, well known but not re-checked this round; to confirm, not verified.

Retention minimums

AML record keeping applies to transactions, customer records (counted from the end of the relationship), alerts and cases, decisions, reports and the audit log. When several laws apply, the strictest wins.

Sanctions and PEP screening records (potential matches, how each was decided, cleared false positives) get the same minimum, as a result of customer due diligence (FATF R.11). It is counted from the later of the match’s closing and the end of the customer relationship; for a counterparty, from the last transaction it was seen in. Open matches are never purged, and hold their customer like an open case does. See Retention: screening records.

Jurisdiction	Minimum	Source	Confidence
Ghana	5 years	AML Act 2020 (Act 1044) s.32(3), “not less than five years”; s.32(7): then to the Public Records and Archives	Checked
Nigeria	5 years	Money Laundering (Prevention and Prohibition) Act 2022 s.8(1)	Checked
Kenya	7 years	POCAMLA s.46(4) (longer if the FRC requires)	Checked; the 2023 amendments not checked
Côte d’Ivoire	10 years	UEMOA uniform AML/CFT law art. 35 (Law 2016-992), now Ordonnance 2023-875	Checked; numbering under the Ordonnance to confirm
Sénégal	10 years	UEMOA uniform law as transposed (Law 2018-03, amended by Law 2024-08)	Secondary; numbering to confirm
Other UEMOA countries (Benin, Burkina Faso, Guinea-Bissau, Mali, Niger, Togo)	10 years	UEMOA uniform AML/CFT law art. 35	Secondary
South Africa	5 years	FIC Act 38 of 2001 ss.22-23	Established
EU	5 years	Directive 2015/849 Art. 40; Regulation 2024/1624 Art. 77 from 10 July 2027 (then delete; five more years possible)	Established
UK	5 years	Money Laundering Regulations 2017 reg. 40 (then delete unless an exception applies)	Established
Anywhere else	5 years	FATF Recommendation 11	Established

Account events and staff notifications aren’t AML records: they have product floors (90 and 30 days) rather than legal minimums.

Data subject request deadlines

Law	Deadline SpeculaPro uses	Extension
Ghana	40 days for access (s.35(10)); 21 days for objection (s.39(2)) and, by analogy, restriction	None
Nigeria	30 days (GAID 2025, to confirm)	Not stated
Kenya	7 days access; 14 days rectification, erasure, restriction, objection; 30 days portability (Regulations 2021)	None
Côte d’Ivoire	30 days (no deadline in the law)	n/a
Sénégal	30 days (art. 69 for rectification and deletion)	n/a
South Africa	30 days (PAIA s.56(1))	One extension of up to 30 days (PAIA s.57)
EU	One month (Art. 12(3))	Up to two further months
UK	One month (Art. 12A)	Up to two further months; stop-the-clock

Breach notification

Law	To the authority	To people	Fixed hours?
Ghana Act 843 s.31	As soon as reasonably practicable	As soon as reasonably practicable	No
Nigeria NDPA s.40	72 hours, if a risk is likely	Immediately, if high risk	Yes
Kenya DPA s.43	72 hours, if a real risk of harm	Within a reasonably practical period	Yes
South Africa POPIA s.22	As soon as reasonably possible	As soon as reasonably possible	No
EU GDPR Arts. 33-34	72 hours, unless a risk is unlikely	Without undue delay, if high risk	Yes
UK GDPR Arts. 33-34	72 hours, unless a risk is unlikely	Without undue delay, if high risk	Yes
Côte d’Ivoire, Sénégal, ECOWAS 2010, Malabo	No statutory duty	No statutory duty	n/a

Per law

Ghana: Data Protection Act 2012 (Act 843)

Checked against the primary text.

• Authority: Data Protection Commission (DPC).
• Registration: duty to register (s.27(1)); the application names the countries data may go to (s.47(1)(g)); renewal every two years (s.50); processing while unregistered is prohibited (s.53) and an offence (s.56); changes notified within 14 days (s.55). Record the reference and expiry in Registers → Settings.
• Requests: access “promptly and in any event within forty days” (s.35(10)), with no extension; a notice to stop processing answered within 21 days (s.39(2)); correction and deletion (s.33) have no fixed period. No portability right.
• Breach (s.31): notify the Commission and the people affected as soon as reasonably practicable after discovery; notice to people is delayed if a security agency or the Commission says it would impede a criminal investigation (s.31(4)).
• Transfers: no general transfer chapter; data from abroad follows the law of its origin (s.18(2)); foreign processors must comply with Ghanaian law (s.30(4)); destinations are declared at registration.
• DPO: an optional “data protection supervisor” (s.58).
• AML exemption: retention required or authorised by law (s.24(1)(a)); crime prevention and detection (s.61); disclosure required by an enactment (s.66).
• Tipping-off: Act 1044 s.38(4)-(7), offence s.48. The STR is due within 24 hours (s.38(1)).

Nigeria: Data Protection Act 2023 (NDPA)

Checked against the primary text.

• Authority: Nigeria Data Protection Commission (NDPC).
• Registration: controllers and processors “of major importance” register within six months (s.44; definition in s.65).
• Requests: the Act says “without undue delay” (s.34) and sets no number of days. The GAID 2025 (in force 19 September 2025) reportedly sets 30 days, which SpeculaPro uses. To confirm.
• Breach (s.40): to the NDPC within 72 hours of becoming aware, where a risk is likely (s.40(2)); to the people affected immediately if the risk is high (s.40(3)); information may be given in phases (s.40(9)); a breach record must be kept (s.40(8)).
• Transfers: adequacy, binding corporate rules, contractual clauses, codes or certification (s.41), with the basis recorded (s.41(2)); adequacy criteria s.42; derogations s.43.
• DPO: mandatory for controllers of major importance (s.32).
• AML exemption: legal obligation (s.25(1)(b)(ii)); erasure only where there is “no other lawful basis to retain” (s.34(2)(b)).
• Rights: access, rectification, erasure and restriction (s.34); objection (s.36); automated decisions (s.37); portability (s.38).
• AML: retention MLPPA 2022 s.8(1); tipping-off s.19(1)(a).

Kenya: Data Protection Act 2019 and General Regulations 2021

Checked against the primary text.

• Authority: Office of the Data Protection Commissioner (ODPC).
• Registration: ss.18-19, with thresholds set by the 2021 Registration Regulations (secondary).
• Requests: access 7 days, free (reg. 9(4)); rectification 14 days, with a refusal notice within 7 days (reg. 10(4)); erasure 14 days (reg. 12(3)); restriction 14 days (reg. 7(3)); objection 14 days (reg. 8(3)); portability 30 days (reg. 11(3)). No extension.
• Breach (s.43): to the Data Commissioner “without delay, within seventy-two hours” where there is a real risk of harm, with reasons if later; to the people affected in writing within a reasonably practical period; processor to controller within 48 hours (s.43(3)); notice to people may be delayed for a criminal investigation (s.43(4)); none is needed if the data was unintelligible, for example encrypted (s.43(6)).
• Transfers: proof of appropriate safeguards to the Commissioner (s.48); sensitive data needs consent plus safeguards (s.49); localisation power (s.50).
• DPO: optional (s.24).
• AML exemption: retention required by law (s.39(1)(a)); erasure doesn’t apply to a legal obligation (reg. 12(4)(b)); evidence is restricted instead of erased (s.40(3)).
• AML: POCAMLA s.46(4) (seven years); tipping-off POCAMLA s.8.

Côte d’Ivoire: Law 2013-450

Checked against the primary text.

• Authority: ARTCI (art. 46).
• Formalities: declaration (art. 5); authorisation (art. 7) for data on offences, national ID numbers, biometrics and transfers to third countries. AML and fraud monitoring very likely needs ARTCI authorisation. ARTCI decides within one month, extendable by one month (art. 11); silence counts as a refusal. Appointing a “correspondant” (art. 12) exempts from declaration (art. 6). Annual report to the authority (art. 42).
• Requests: no deadline in the law (arts. 29-31); SpeculaPro uses 30 days. Portability exists (art. 38).
• Breach: no statutory notification duty; art. 41 sets security duties only. SpeculaPro records it with no deadline and suggests a voluntary notice. ARTCI decisions not checked.
• Transfers: only to countries with an equivalent or higher level of protection, with prior ARTCI authorisation (art. 26, art. 7).
• AML exemption: no erasure where retention is needed to comply with a legal obligation (art. 35); no objection to processing the law provides for (art. 30).
• AML: Law 2016-992 art. 35 (ten years), tipping-off art. 82; replaced by Ordonnance 2023-875, numbering to confirm.

Sénégal: Law 2008-12

Checked against the primary text.

• Authority: Commission de protection des données personnelles (CDP).
• Formalities: declaration (art. 18); authorisation (art. 20), including for data on offences, national ID and biometrics. The CDP decides within two months (art. 23).
• Requests: rectification and deletion within one month (art. 69); no access deadline (arts. 62-63), so SpeculaPro uses 30 days. No portability right.
• Breach: no statutory duty.
• Transfers: sufficient protection, with prior notice to the CDP (art. 49); derogations art. 50; CDP authorisation otherwise (art. 51).
• AML exemption: no objection where processing meets a legal obligation (art. 68).
• Pending changes: a new data protection law is in draft, not adopted (secondary). The AML law is Law 2018-03 as amended by Law 2024-08: numbering to confirm.

South Africa: POPIA and PAIA

• Authority: Information Regulator.
• Information Officer: duties s.55, deputies s.56 (established); registers with the Regulator through the eServices portal (secondary).
• Prior authorisation (s.57), checked: needed for processing information on criminal or objectionable conduct on behalf of third parties, which is relevant to shared fraud databases.
• Requests: access goes through PAIA (POPIA ss.23, 25): decide within 30 days (PAIA s.56(1)), with one extension of up to 30 days (s.57) (established); correction and deletion “as soon as reasonably practicable” (s.24) (established).
• Breach (s.22), checked: to the Regulator and the people affected “as soon as reasonably possible after the discovery”; delay only on a public body’s or the Regulator’s say-so (s.22(3)).
• Transfers: s.72 (established).
• AML exemption: retention required by law (s.14(1)(a)).
• AML: FIC Act ss.22-23 (five years); tipping-off s.29(3)-(4) (established).

EU: GDPR

Established, not re-checked this round.

• Requests: one month, extendable by two months; the person must be told within the first month (Art. 12(3)). Months are counted to the same date, or the last day of a shorter month.
• Breach: to the authority without undue delay and, where feasible, within 72 hours, unless a risk is unlikely (Art. 33); to people without undue delay if the risk is high (Art. 34); contents Art. 33(3), which the regulator export covers.
• AML exemption: legal obligation (Art. 17(3)(b)); restrictions including the prevention and detection of crime (Art. 23(1)(d)).
• Records and roles: record of processing (Art. 30), DPO (Arts. 37-39), transfers (Chapter V, Arts. 44-49).
• AML: Directive 2015/849 Art. 40, then Regulation 2024/1624 Art. 77; tipping-off Art. 39, then AMLR Art. 73 (checked).

UK: UK GDPR, DPA 2018 and the Data (Use and Access) Act 2025

• The same core articles as the EU GDPR. The ICO’s breach deadline is also 72 hours (established).
• Data (Use and Access) Act 2025 (secondary): Art. 12A, in force 5 February 2026, sets one month from the “relevant time” (the latest of receipt, identity confirmation and fee), with a stop-the-clock while the controller waits for proof of identity or a clarification (Art. 12A(5)). On a UK request you can stop and restart the clock; the month still counts from the received time, so enter the relevant time there if it is later.
• Crime and taxation exemption: DPA 2018 Sch. 2 Pt 1 para 2. The ICO accepts it for withholding subject access data that would tip off under POCA 2002 s.333A.
• AML: MLR 2017 reg. 40 (five years, then delete).

Regional frameworks

These set no deadlines of their own; they apply through national laws.

• ECOWAS Supplementary Act A/SA.1/01/10 (2010), checked: declaration (art. 5) and authorisation (art. 12); rights of information (art. 38), access (art. 39), objection (art. 40), rectification and destruction (art. 41); transfers outside ECOWAS only with an adequate level of protection, the authority informed beforehand (art. 36). A revised Act was reportedly adopted on 19 July 2026, adding 72-hour breach notice, a DPO and portability (one source). It isn’t yet published and has up to three years for transposition.
• AU Malabo Convention (2014; in force 8 June 2023), checked: formalities art. 10, with authorisation for offence data (art. 10.4(b)); principles art. 13; legal obligation for sensitive data art. 14.2(h); rights arts. 16-19; transfers outside the AU only with adequate protection or authorisation (art. 14.6(a)).

Open legal points

These are unresolved. Confirm them with counsel for your institution:

• Nigeria: the GAID 2025 article that sets the 30-day deadline for data subject requests.
• Côte d’Ivoire and Sénégal: the article numbering under the new AML texts (Ordonnance 2023-875 in Côte d’Ivoire; Law 2024-08 in Sénégal) for retention and tipping-off; and whether AML monitoring, and SaaS hosting outside the country, need prior authorisation (Côte d’Ivoire: ARTCI, Law 2013-450 art. 7 and art. 26; Sénégal: the CDP, Law 2008-12 art. 20 and the transfer notice in art. 49). Also whether ARTCI has issued a breach notification rule.
• Kenya: whether the 2023 POCAMLA amendments changed the seven-year retention in s.46.
• South Africa: whether the prior authorisation in POPIA s.57 applies to the institution’s use.
• ECOWAS: when the revised Supplementary Act is published, and its transposition dates.
• Everywhere: whether pseudonymising records after their retention period counts as erasure under each law. SpeculaPro lets each workspace choose to delete instead (see Delete or pseudonymise?).
• Screening: whether screening results count as customer due diligence records, kept for the whole relationship plus the minimum (as SpeculaPro does), or only from each match’s closing, like alerts. For the EU and the UK, which also require deletion, this decides the latest date.
• Screening: whether an open or confirmed sanctions match should send a data subject request to the MLRO, as an open case or an STR does. Today it does not; the export leaves screening out for everyone.
• Screening: a workspace’s own imported watch lists hold personal data about people who are not its customers. They have no retention period and are outside data subject requests in SpeculaPro.

Related

• Data protection overview
• Retention and legal holds
• Data subject requests
• Breach register
• Tipping off and confidentiality