Namibia: AI governance ahead of the data law

In Windhoek, teams at banks, mining companies and tour operators already use ChatGPT, Copilot and Gemini to save time. Yet Namibia does not yet have a general law on personal data protection. Many executives conclude that they can wait.

That is a poor bet. The bill is moving forward, the Constitution already protects privacy and international partners set their own requirements. Companies that organise their AI governance now will not have to start over the day the law is passed.

Where Namibia's framework stands

The Data Protection Bill has been in preparation for more than ten years. The Ministry of Information and Communication Technology opened it to public comment in October 2022, and a new version circulated in 2023. In August 2025, Minister Emma Theofelus announced that the text was in its final stages and would be tabled in Parliament later in 2025.

According to the latest public information we could verify, the law is not yet in force and no supervisory authority has been set up. The exact timetable is therefore worth watching closely.

What the bill signals

The 2023 version gives a clear idea of the direction. It provides for:

An independent supervisory authority with investigation and enforcement powers.
A broad scope covering public and private organisations in every sector, and reaching responsible parties wherever they are located when people in Namibia are concerned.
Rules on transfers abroad: they would be allowed if the recipient is subject to comparable protection, if the data subject consents, or if the transfer is needed to perform a contract with them.
Penalties that can include fines and prison sentences.

The final text may still change. But these principles resemble those of neighbouring laws such as South Africa's POPIA. For a company, they are reliable reference points. A group already present in South Africa or Europe has every reason to apply the same standard in Namibia rather than run two different policies.

Article 13: privacy is already a right

The absence of a specific law does not mean the absence of rules. Article 13 of the Namibian Constitution protects the right to privacy, including the privacy of homes, correspondence and communications. Any interference must be in accordance with law and justified.

In practice, a company that lets customer or employee data flow unchecked to AI services abroad is already exposed to legal and reputational risk. Once the law takes effect, these practices will also become regulatory offences.

Administrative office of a mining company in Namibia, an employee handles files on her computer

AI is moving faster than the law

On 11 August 2025, the National Commission on Research, Science and Technology (NCRST) presented Namibia's AI Readiness Assessment Report, based on UNESCO's methodology. Its finding is blunt: the country lacks a clear governance structure and regulatory framework for AI. It recommends a coordinated, human rights based approach, with more transparency and accountability.

Inside companies, this shows up as shadow AI. Mining contracts summarised in an assistant, bank customer lists sent for analysis, travellers' passports copied to plan an itinerary. Nobody means harm, but nobody measures what leaves. And since no authority yet receives breach notifications, these leaks stay invisible, including to management. We break down this hidden cost in the real cost of shadow AI in 2026.

A four-step strategy to get ahead

Waiting for the law before acting means doing everything at once, under the pressure of a compliance deadline. It is better to move step by step.

Take stock. Identify which AI tools are used, by whom and with what data. Without visibility, no policy holds. Start with the teams that handle the most personal data: HR, finance, customer relations.
Set simple rules. A one-page policy stating what must never go into a prompt: identity data, bank details, health data, confidential contracts. Training helps, but it is not enough, as shown in why AI security training doesn't work.
Protect technically. Detect and anonymise sensitive data before it leaves the workstation, rather than banning AI.
Document. Keep a record of prevented incidents and decisions taken. It will form the basis of your compliance file once the authority exists.

To put these steps on a timeline, our 90-day AI DLP rollout playbook offers a concrete schedule. Groups that also work with Europe can draw on our EU AI Act and GDPR compliance checklist to aim for a demanding standard right away.

Summary

Namibia does not yet have a data protection law in force, but the direction is known: an independent authority, controlled transfers, penalties. The Constitution already protects privacy, and AI use is growing without a framework. Companies that act now will turn a future constraint into an advantage. ZeusLock helps them do it: it detects sensitive data in prompts and files on devices and browsers, anonymises it while keeping its format, warns or blocks, and logs every event.

Want to prepare your Namibian teams today? Book a ZeusLock demo.