Editor’s Note: Latitude59, the Estonia-born startup conference, said in October that it will hold events in Singapore on Oct. 28, in Lusaka, Zambia, and Kampala, Uganda, in November, and in Nairobi, Kenya, on Dec. 3 and 4, where organizers expect about 2,000 attendees, among them 600 investors. Each stop sits under its own data-protection statute.
Kenya’s registration exemption for small firms does not reach health, education or financial services, and its regulations require local processing, or at least a local copy, for basic-education and primary or secondary health data. Zambia defaults to keeping personal data on servers in the country. Singapore requires breach notice as soon as practicable and no later than three calendar days after a breach is assessed as notifiable, an assessment that must itself be prompt. In July 2025, Uganda’s data-protection office found that Google had failed to register and had moved complainants’ data abroad without demonstrating adequate safeguards; Google argued it was exempt and outside the law’s reach, then withdrew its appeal, complainants said.
For cybersecurity, privacy, compliance and eDiscovery professionals advising startups or their investors, those rules set the diligence list: registration, data location, breach clocks and transfer routes. Watch how Kenya applies its September transfer guidance.
Content Assessment: Latitude59's four-country push puts startup deals in front of four data-protection laws
Information - 92%
Insight - 90%
Relevance - 88%
Objectivity - 90%
Authority - 92%
90%
Excellent
A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Latitude59's four-country push puts startup deals in front of four data-protection laws."
Industry News – Technology Beat
Latitude59’s four-country push puts startup deals in front of four data-protection laws
ComplexDiscovery Staff
Latitude59, the Estonia-born startup conference, will hold events in Singapore, Kenya, Uganda and Zambia before year-end, it said in a release dated Oct. 20, carrying the deal-making it hosts into four data-protection regimes.
The announcement reads like an events calendar. For counsel advising the companies that pitch on those stages, or the funds that back them afterward, it doubles as a map of registration duties, breach clocks and transfer rules. Which of those rules bite depends on what a company does with personal data in each market, and on where that data goes next.
Four stops between late October and early December
The run opens in Singapore on Oct. 28 with Singapore x New Nordics Night of Innovation & Investment, an official side event of SWITCH. The Singapore Week of Innovation and Technology runs Oct. 27 to 29 at Marina Bay Sands. Latitude59 said it organizes the evening with the Embassy of Estonia in Singapore, Nordic Singapore Innovation Days and the Swedish Energy Agency. Latitude59 Chief Executive Liisi Org said Singapore is now home to over 1,200 deep tech startups and that organizers expect over 100 delegates to make the trip.
Africa comes next, starting with two first-time stops. Lusaka hosts a one-day event on Nov. 5 and Kampala follows the next week, each pairing an idea hackathon for hubs, incubators and accelerators with an evening mixer, according to the conference’s event page. Latitude59 hosts both events with ESTDEV, the Estonian Centre for International Development, which lists the conference as its partner on a 74,964-euro development-cooperation project in Uganda and Zambia. The strongest teams from each city will be chosen to present in Nairobi.
Nairobi closes the sequence on Dec. 3 and 4, the fourth consecutive year Latitude59 has come to Kenya. Organizers said last year’s Kenya edition drew about 2,000 participants and that they expect roughly the same this year, among them 600 investors drawn from Africa, Europe, the Nordics and Asia. An invite-only investor day on Dec. 3 is billed as “a half-day gathering of 200 top African and European investors, development finance institutions (DFIs), and select policymakers,” with the main conference following on Dec. 4.
Org described the conference as rooted in Estonia and built to bridge countries, continents and startup communities. Latitude59 organizes the meetings rather than making the investments: its events put founders, investors and the people who run startup hubs and accelerators in the same rooms. The organization, which bills itself as “the largest startup and technology event in the Baltics,” has held its flagship conference in Tallinn since 2012. It said this May’s 14th edition drew over 3,000 participants, including 800 startup representatives.
Why the program itself points toward regulation
Those bridges carry legal freight, and the Kenya agenda says so. Its published themes include a policy track of structured dialogues between public sector leaders and tech builders “to address regulatory bottlenecks,” alongside sector deep-dives in healthtech, edtech and fintech, three fields that typically hold customer records. The organizers’ summary of their May opening event in Tallinn landed in the same place: the message, they wrote, was that “legal frameworks must keep pace with technology, or innovation moves elsewhere.”
For diligence, that framing has a practical edge: an investor meeting a Nairobi health startup in December is also meeting Kenya’s Data Protection Act of 2019 and the regulations written under it. A founder seeking Singaporean or European capital will have to explain where patient records go, if they go anywhere.
The events run on personal data too. Latitude59’s Kenya program says attendees can book one-on-one meetings through its matchmaking app, which goes live a fortnight ahead of the conference, and the Lusaka and Kampala gatherings take sign-ups through online registration listings. An organizer collecting attendee details across four countries can meet versions of the same registration, breach and transfer questions as the startups on stage, depending on where those records are kept and who can reach them.
Kenya’s rules single out health and education
Kenya’s statute starts with registration, and its regulations decide who is caught. The rules fall on data controllers, the organizations that decide why and how personal data is processed, and on data processors, which handle it on a controller’s behalf. Organizations with annual turnover under 5 million Kenyan shillings and fewer than 10 employees are exempt. The exemption does not cover anyone operating an educational institution, handling health administration or patient care, or providing financial services, among other listed purposes. Where a breach creates a real risk of harm, a controller must notify the Data Commissioner without delay and within 72 hours of becoming aware of it.
The commissioner’s office has also set out how data may leave. Its 2026 Guidance Notes for Cross-border Data Transfers, posted in September and reported by ITWeb Africa on Sept. 9, set out four routes under the 2021 general regulations. Data can leave with appropriate safeguards, on an adequacy decision by the commissioner, out of necessity, or with the data subject’s consent. In her foreword, Data Commissioner Immaculate Kassait wrote that the document offers “practical guidance on the conditions for lawful cross-border transfers” and is “not intended to replace or override the provisions of the Act or the General Regulations.” The act’s necessity grounds include establishing or defending a legal claim, and sensitive personal data needs both the data subject’s consent and confirmation of appropriate safeguards.
The guidance also defines a transfer broadly, covering not only sending personal data out of Kenya but also giving someone abroad access to it or otherwise putting it within their reach. It adds that running personal data through cloud servers abroad counts as a cross-border transfer in its own right, which turns a hosting choice into a legal one. Some data must keep a foot in Kenya regardless of route. Regulation 26 lists six processing purposes as strategic interests of the state, including early childhood and basic education and primary or secondary health care. The guidance says data processed for them must run through a server and data center in Kenya or keep at least one serving copy there. Under the act as the commissioner’s office publishes it, administrative fines reach 5 million Kenyan shillings or 1 percent of an undertaking’s annual turnover, whichever is lower.
Uganda and Zambia add a test case and a localization default
The two first-time stops approach the same concern differently. Uganda’s Data Protection and Privacy Act of 2019 lets a Uganda-based controller or processor handle personal data abroad only where the destination country offers protection at least equivalent to the act or the data subject consents. The act also requires registration, and that duty now has a test case behind it.
Uganda’s Personal Data Protection Office found on July 18, 2025, that Google LLC had collected and processed four Ugandan complainants’ personal data without registering and had moved it abroad without demonstrating adequate safeguards. The office ordered the company to register within 30 days. That account comes from the Uganda Registration Services Bureau, a government agency, and matches reports by the policy group CIPESA and the law firm Cliffe Dekker Hofmeyr. Google had argued that it was exempt and that the act’s reach beyond Uganda covered only entities domiciled there, the bureau’s account says, and HapaKenya reported that the office rejected the company’s no-physical-presence position. Condia, citing a LinkedIn post by lead complainant Ssekamwa Frank, and HapaKenya reported in late November and early December 2025 that Google had withdrawn its appeal and agreed to comply; neither report carried a statement from Google.
Zambia’s Data Protection Act of 2021 sets a stricter default. Controllers and processors must register with the Office of the Data Protection Commissioner. When a security breach affects personal data, the controller has 24 hours to notify the commissioner, while a processor must alert its controller as soon as practicable. The act requires a data controller to keep personal data, for processing and storage alike, on servers or in data centers inside Zambia unless the minister prescribes categories that may be stored elsewhere. Sensitive personal data must be processed and stored there even then.
Transfers abroad are the exception. The act allows them in limited cases, such as the data subject’s consent paired with commissioner-approved contracts. A separate subsection addresses sending sensitive personal data out with the subject’s explicit consent, alongside emergency transfers to health or emergency services and certain transfers the commissioner finds necessary. Counsel will need to read that subsection in full with the storage rule before relying on consent alone.
Singapore measures its window from the assessment
Singapore, where the calendar begins, writes its rules around comparable protection rather than Zambia-style local storage. Its Personal Data Protection Act sets no general registration requirement, though every organization must designate someone responsible for compliance, and it lets organizations send personal data abroad only under prescribed requirements meant to secure protection comparable to the act. An organization that has reason to believe a breach occurred must assess, in a reasonable and expeditious manner, whether it is notifiable. If it is, the organization must tell the Personal Data Protection Commission as soon as practicable and no later than three calendar days after the day of that assessment. For contraventions since Oct. 1, 2022, financial penalties can reach 10 percent of annual turnover in Singapore for organizations with local turnover above S$10 million, and S$1 million in other cases.
Four questions before the term sheet
Those statutes reduce to a short checklist for practitioners on either side of a deal struck at these events. First, find out whether registration is required in each country and confirm it where it is. Kenya, Uganda and Zambia run registration regimes, while Singapore asks instead for a designated compliance lead. Second, find out where the data physically sits, given Zambia’s local-storage default and Kenya’s local-copy rule. Third, map the breach clocks and what starts each one. A Zambian controller has 24 hours from a security breach and a Kenyan controller 72 hours from awareness of a breach posing a real risk of harm. A Singapore organization must notify as soon as practicable and no later than three calendar days after the day of a prompt assessment. Uganda’s act calls for immediate notice to its regulator once a company believes personal data has been accessed or acquired without authorization. Fourth, ask how each transfer is papered, whether by consent, contract, adequacy or regulator approval.
The same answers matter to discovery teams if a deal ends in a dispute or an investigation. Collection plans for a Zambian portfolio company begin with the server’s location and who can reach it. In Kenya, the guidance’s definition means a reviewer abroad opening Kenyan records is already part of the transfer analysis, and a transfer for litigation could rely on the act’s legal-claims ground where the transfer is necessary.
Krista Meinarde, Latitude59’s head of investor-startup relations, said in an Oct. 6 release that the Kenya pitch competition wants “a functioning MVP, clear traction, and teams that are actively fundraising.” MVP is startup shorthand for minimum viable product, a working first version. A health or education startup pitching in Nairobi may already process patient or pupil records, which puts the Kenya rules above squarely in its diligence file. If the 600 investors organizers expect arrive looking for scalable companies, should the data map travel with the pitch deck?
Editor’s disclosure: ComplexDiscovery OÜ, which is registered in Tallinn, Estonia, has held press credentials for Latitude59 events.

News Sources
- Latitude59 Expands Its Global Reach with Events in Four Countries (Latitude 59)
- Latitude59 returns to Kenya and opens applications for its Pitch Competition 2026 (Latitude59)
- Skills over capital: inside the Latitude59 x Kenya 2026 program (Latitude59)
- Uganda and Zambia | Latitude59xKenya pre-events (Latitude59)
- Latitude59 | Startup & Tech Event (Latitude59)
- Latitude59 x ESTDEV: Uganda Ecosystem Mixer (Latitude59 via Luma)
- Latitude59 Singapore (Latitude59)
- Latitude59 2026 (Latitude59)
- Latitude59 Green & Digital Bridge: Strengthening Innovation Ecosystems in Uganda and Zambia for Green and Digital Transition (ESTDEV)
- Home | Singapore Week of Innovation and Technology (Enterprise Singapore)
- The Data Protection Act, No. 24 of 2019 (Office of the Data Protection Commissioner, Kenya)
- The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (Office of the Data Protection Commissioner, Kenya)
- ODPC: Guidance Notes for Cross-border Data Transfers (Office of the Data Protection Commissioner, Kenya, Sept. 2026)
- The Data Protection (General) Regulations, 2021 (Office of the Data Protection Commissioner, Kenya)
- Data Protection and Privacy Act (Chapter 97) (ULII and Laws.Africa)
- Data Protection and Privacy Act 2019 (Parliament of Uganda)
- The Data Protection Act, 2021 (Data Protection Commission, Zambia)
- Data Protection Act (Commencement) Order, 2021 (ZambiaLII)
- Personal Data Protection Act 2012 (Attorney-General’s Chambers of Singapore, Singapore Statutes Online)
- Required to Notify The PDPC (Personal Data Protection Commission Singapore)
- Uganda’s Data Protection Office Finds Google in Breach of Privacy (Uganda Registration Services Bureau)
- Kenya tightens cross border data transfer rules (ITWeb Africa)
- Ugandan Regulator Finds Google in Breach of Country’s Data Protection Law, Orders Local Registration (CIPESA)
- Google agrees to comply with Uganda’s data privacy law (Condia)
- Google commits to comply with Uganda’s data protection law after court case (HapaKenya)
- To Register or Not to Register: The Ugandan Personal Data Protection Office’s Decision on the Registration of Data Controllers (Cliffe Dekker Hofmeyr via Afriwise)
- Transfer Of Personal Data Outside Kenya (CMS)
- Data Localisation Requirements under the Data Protection Act (ALN via Afriwise)
- Increased maximum financial penalties under Personal Data Protection Act 2012 from 1 October 2022 (Allen & Gledhill)
Assisted by GAI and LLM Technologies
Additional reading
- Slush 2026 brings a smaller, sharper bet on European startups to Helsinki
- Tallinn Digital Summit 2026 puts the agentic state to the test
- Nine months across Europe’s tech-sovereignty arc, from Tallinn to London
- The flame and the frontier: how Estonia carries a 1919 victory into a tense 2026
- Estonia aims to be first to give AI agents official digital IDs
- Parliament hits pause on high-risk AI rules and bans nudifier apps
- Europe’s AI labeling rules arrive with a voluntary code and a hard deadline
Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.































