A new Data Protection Act was passed in March 2022. There was no legal instrument governing data flows before then. See Section 33(1) requiring an adequate level of protection to be ensured in the country of the recipient where data is transferred. Note that under Section 32 there is a more open data transfer mechanism within SADC Member States. 