Editor’s Note: Latitude59, the Estonia-born startup conference, said in October that it will hold events in Singapore on Oct. 28, in Lusaka, Zambia, and Kampala, Uganda, in November, and in Nairobi, Kenya, on Dec. 3 and 4, where organizers expect about 2,000 attendees, among them 600 investors. Each stop sits under its own data-protection statute.

Kenya’s registration exemption for small firms does not reach health, education or financial services, and its regulations require local processing, or at least a local copy, for basic-education and primary or secondary health data. Zambia defaults to keeping personal data on servers in the country. Singapore requires breach notice as soon as practicable and no later than three calendar days after a breach is assessed as notifiable, an assessment that must itself be prompt. In July 2025, Uganda’s data-protection office found that Google had failed to register and had moved complainants’ data abroad without demonstrating adequate safeguards; Google argued it was exempt and outside the law’s reach, then withdrew its appeal, complainants said.

For cybersecurity, privacy, compliance and eDiscovery professionals advising startups or their investors, those rules set the diligence list: registration, data location, breach clocks and transfer routes. Watch how Kenya applies its September transfer guidance.


Content Assessment: Latitude59's four-country push puts startup deals in front of four data-protection laws

Information - 92%
Insight - 90%
Relevance - 88%
Objectivity - 90%
Authority - 92%

90%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Latitude59's four-country push puts startup deals in front of four data-protection laws."


Industry News – Technology Beat

Latitude59’s four-country push puts startup deals in front of four data-protection laws

ComplexDiscovery Staff

Latitude59, the Estonia-born startup conference, will hold events in Singapore, Kenya, Uganda and Zambia before year-end, it said in a release dated Oct. 20, carrying the deal-making it hosts into four data-protection regimes.

The announcement reads like an events calendar. For counsel advising the companies that pitch on those stages, or the funds that back them afterward, it doubles as a map of registration duties, breach clocks and transfer rules. Which of those rules bite depends on what a company does with personal data in each market, and on where that data goes next.



Four stops between late October and early December

The run opens in Singapore on Oct. 28 with Singapore x New Nordics Night of Innovation & Investment, an official side event of SWITCH. The Singapore Week of Innovation and Technology runs Oct. 27 to 29 at Marina Bay Sands. Latitude59 said it organizes the evening with the Embassy of Estonia in Singapore, Nordic Singapore Innovation Days and the Swedish Energy Agency. Latitude59 Chief Executive Liisi Org said Singapore is now home to over 1,200 deep tech startups and that organizers expect over 100 delegates to make the trip.

Africa comes next, starting with two first-time stops. Lusaka hosts a one-day event on Nov. 5 and Kampala follows the next week, each pairing an idea hackathon for hubs, incubators and accelerators with an evening mixer, according to the conference’s event page. Latitude59 hosts both events with ESTDEV, the Estonian Centre for International Development, which lists the conference as its partner on a 74,964-euro development-cooperation project in Uganda and Zambia. The strongest teams from each city will be chosen to present in Nairobi.

Nairobi closes the sequence on Dec. 3 and 4, the fourth consecutive year Latitude59 has come to Kenya. Organizers said last year’s Kenya edition drew about 2,000 participants and that they expect roughly the same this year, among them 600 investors drawn from Africa, Europe, the Nordics and Asia. An invite-only investor day on Dec. 3 is billed as “a half-day gathering of 200 top African and European investors, development finance institutions (DFIs), and select policymakers,” with the main conference following on Dec. 4.

Org described the conference as rooted in Estonia and built to bridge countries, continents and startup communities. Latitude59 organizes the meetings rather than making the investments: its events put founders, investors and the people who run startup hubs and accelerators in the same rooms. The organization, which bills itself as “the largest startup and technology event in the Baltics,” has held its flagship conference in Tallinn since 2012. It said this May’s 14th edition drew over 3,000 participants, including 800 startup representatives.

Why the program itself points toward regulation

Those bridges carry legal freight, and the Kenya agenda says so. Its published themes include a policy track of structured dialogues between public sector leaders and tech builders “to address regulatory bottlenecks,” alongside sector deep-dives in healthtech, edtech and fintech, three fields that typically hold customer records. The organizers’ summary of their May opening event in Tallinn landed in the same place: the message, they wrote, was that “legal frameworks must keep pace with technology, or innovation moves elsewhere.”

For diligence, that framing has a practical edge: an investor meeting a Nairobi health startup in December is also meeting Kenya’s Data Protection Act of 2019 and the regulations written under it. A founder seeking Singaporean or European capital will have to explain where patient records go, if they go anywhere.

The events run on personal data too. Latitude59’s Kenya program says attendees can book one-on-one meetings through its matchmaking app, which goes live a fortnight ahead of the conference, and the Lusaka and Kampala gatherings take sign-ups through online registration listings. An organizer collecting attendee details across four countries can meet versions of the same registration, breach and transfer questions as the startups on stage, depending on where those records are kept and who can reach them.

Kenya’s rules single out health and education

Kenya’s statute starts with registration, and its regulations decide who is caught. The rules fall on data controllers, the organizations that decide why and how personal data is processed, and on data processors, which handle it on a controller’s behalf. Organizations with annual turnover under 5 million Kenyan shillings and fewer than 10 employees are exempt. The exemption does not cover anyone operating an educational institution, handling health administration or patient care, or providing financial services, among other listed purposes. Where a breach creates a real risk of harm, a controller must notify the Data Commissioner without delay and within 72 hours of becoming aware of it.

The commissioner’s office has also set out how data may leave. Its 2026 Guidance Notes for Cross-border Data Transfers, posted in September and reported by ITWeb Africa on Sept. 9, set out four routes under the 2021 general regulations. Data can leave with appropriate safeguards, on an adequacy decision by the commissioner, out of necessity, or with the data subject’s consent. In her foreword, Data Commissioner Immaculate Kassait wrote that the document offers “practical guidance on the conditions for lawful cross-border transfers” and is “not intended to replace or override the provisions of the Act or the General Regulations.” The act’s necessity grounds include establishing or defending a legal claim, and sensitive personal data needs both the data subject’s consent and confirmation of appropriate safeguards.

The guidance also defines a transfer broadly, covering not only sending personal data out of Kenya but also giving someone abroad access to it or otherwise putting it within their reach. It adds that running personal data through cloud servers abroad counts as a cross-border transfer in its own right, which turns a hosting choice into a legal one. Some data must keep a foot in Kenya regardless of route. Regulation 26 lists six processing purposes as strategic interests of the state, including early childhood and basic education and primary or secondary health care. The guidance says data processed for them must run through a server and data center in Kenya or keep at least one serving copy there. Under the act as the commissioner’s office publishes it, administrative fines reach 5 million Kenyan shillings or 1 percent of an undertaking’s annual turnover, whichever is lower.

Uganda and Zambia add a test case and a localization default

The two first-time stops approach the same concern differently. Uganda’s Data Protection and Privacy Act of 2019 lets a Uganda-based controller or processor handle personal data abroad only where the destination country offers protection at least equivalent to the act or the data subject consents. The act also requires registration, and that duty now has a test case behind it.

Uganda’s Personal Data Protection Office found on July 18, 2025, that Google LLC had collected and processed four Ugandan complainants’ personal data without registering and had moved it abroad without demonstrating adequate safeguards. The office ordered the company to register within 30 days. That account comes from the Uganda Registration Services Bureau, a government agency, and matches reports by the policy group CIPESA and the law firm Cliffe Dekker Hofmeyr. Google had argued that it was exempt and that the act’s reach beyond Uganda covered only entities domiciled there, the bureau’s account says, and HapaKenya reported that the office rejected the company’s no-physical-presence position. Condia, citing a LinkedIn post by lead complainant Ssekamwa Frank, and HapaKenya reported in late November and early December 2025 that Google had withdrawn its appeal and agreed to comply; neither report carried a statement from Google.

Zambia’s Data Protection Act of 2021 sets a stricter default. Controllers and processors must register with the Office of the Data Protection Commissioner. When a security breach affects personal data, the controller has 24 hours to notify the commissioner, while a processor must alert its controller as soon as practicable. The act requires a data controller to keep personal data, for processing and storage alike, on servers or in data centers inside Zambia unless the minister prescribes categories that may be stored elsewhere. Sensitive personal data must be processed and stored there even then.

Transfers abroad are the exception. The act allows them in limited cases, such as the data subject’s consent paired with commissioner-approved contracts. A separate subsection addresses sending sensitive personal data out with the subject’s explicit consent, alongside emergency transfers to health or emergency services and certain transfers the commissioner finds necessary. Counsel will need to read that subsection in full with the storage rule before relying on consent alone.

Singapore measures its window from the assessment

Singapore, where the calendar begins, writes its rules around comparable protection rather than Zambia-style local storage. Its Personal Data Protection Act sets no general registration requirement, though every organization must designate someone responsible for compliance, and it lets organizations send personal data abroad only under prescribed requirements meant to secure protection comparable to the act. An organization that has reason to believe a breach occurred must assess, in a reasonable and expeditious manner, whether it is notifiable. If it is, the organization must tell the Personal Data Protection Commission as soon as practicable and no later than three calendar days after the day of that assessment. For contraventions since Oct. 1, 2022, financial penalties can reach 10 percent of annual turnover in Singapore for organizations with local turnover above S$10 million, and S$1 million in other cases.

Four questions before the term sheet

Those statutes reduce to a short checklist for practitioners on either side of a deal struck at these events. First, find out whether registration is required in each country and confirm it where it is. Kenya, Uganda and Zambia run registration regimes, while Singapore asks instead for a designated compliance lead. Second, find out where the data physically sits, given Zambia’s local-storage default and Kenya’s local-copy rule. Third, map the breach clocks and what starts each one. A Zambian controller has 24 hours from a security breach and a Kenyan controller 72 hours from awareness of a breach posing a real risk of harm. A Singapore organization must notify as soon as practicable and no later than three calendar days after the day of a prompt assessment. Uganda’s act calls for immediate notice to its regulator once a company believes personal data has been accessed or acquired without authorization. Fourth, ask how each transfer is papered, whether by consent, contract, adequacy or regulator approval.

The same answers matter to discovery teams if a deal ends in a dispute or an investigation. Collection plans for a Zambian portfolio company begin with the server’s location and who can reach it. In Kenya, the guidance’s definition means a reviewer abroad opening Kenyan records is already part of the transfer analysis, and a transfer for litigation could rely on the act’s legal-claims ground where the transfer is necessary.

Krista Meinarde, Latitude59’s head of investor-startup relations, said in an Oct. 6 release that the Kenya pitch competition wants “a functioning MVP, clear traction, and teams that are actively fundraising.” MVP is startup shorthand for minimum viable product, a working first version. A health or education startup pitching in Nairobi may already process patient or pupil records, which puts the Kenya rules above squarely in its diligence file. If the 600 investors organizers expect arrive looking for scalable companies, should the data map travel with the pitch deck?

Editor’s disclosure: ComplexDiscovery OÜ, which is registered in Tallinn, Estonia, has held press credentials for Latitude59 events.



News Sources



Assisted by GAI and LLM Technologies

Additional reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals. Learn more at ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, Gemini, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).