Agree one African set of rules on health data for health funding deals
Why this matters
Of the 35 countries with US health deals, 24 are African. Human Rights Watch read seven of the deals. Six ask for wide sharing of health data, and five ask for samples of viruses and their genetic data. In Mozambique, Rwanda and Liberia, the deals allow access to "any data" without clear protections for patients.
Each government is having the same argument on its own. A Kenyan court suspended Kenya's deal in December 2025, and a higher court let it continue in May 2026. Zimbabwe ended talks in February 2026 and Ghana said no in April. On 25 September Zambia said the United States had agreed to replace its data terms.
Africa CDC has been drafting a continental framework for health data since July 2025, and its head has offered help to any country that wants to renegotiate. A framework sets out principles. Negotiators need ready-made clauses they can attach to a deal.
Sources for this section (7)
- KFF: tracker of US health agreements (opens in a new tab)
- Human Rights Watch: assessment of the US health agreements (opens in a new tab)
- Capital FM: Kenya's Court of Appeal on the health deal (opens in a new tab)
- Lawfare: Zimbabwe and Ghana (opens in a new tab)
- Semafor: Zambia and the US health data dispute (opens in a new tab)
- Africa CDC: Africa's health data framework (opens in a new tab)
- CNBC Africa: Africa CDC offers help to renegotiate (opens in a new tab)
Four levels of action
-
What Africa asks of the world
Countries that fund health in Africa, starting with the United States, should accept the African data rules as part of every deal. members should match the global rules on sharing , due in May 2027, to the same standard.
- Who
- The US Department of State; members of WHO
- When
- , May 2027
-
What the African Union does
Africa CDC and the African Union's lawyers write the model rules and circulate them to all 24 African signatories and to Zambia. African health ministers endorse them.
- Who
- Africa CDC and the
- When
- Draft by 28 October 2026; endorsement at the AU summit in February 2027
-
What regional groups do
The West African, East African and Southern African blocs check the rules against their own data laws. West Africa already limits sending personal data to countries without proper protection. The rules are published openly, so Burkina Faso, Niger and Madagascar, which are suspended from AU meetings but have US deals, can also use them.
- Who
- , the and
- When
- By 15 December 2026
-
Which country goes first, and why
Kenya goes first. Its deal is the only one before a court, and Kenyan law already requires health data to be stored in Kenya. Whatever the court decides on 30 October, Kenya will need data terms that meet its own law.
- Who
- Kenya's Ministry of Health and its Commissioner
- When
- At the first review of the deal after the ruling, by 31 January 2027
Before another country can do this
- A data protection law with a regulator that works. Of Africa's countries, 44 have such a law and 38 have a working regulator.
- A rule on where health data must be stored or when it may leave the country, as Rwanda and Kenya have.
- A deal that is being negotiated, renewed or reviewed, so there is a moment to add the rules.
What does not carry over from the first country
- Kenya's case is already before a court that has suspended the deal once. Most countries will need to use a review meeting instead.
- Kenya's deal already requires its data regulator to agree to data access. Others have no such clause.
Who else is ready
| Country | Why | Source |
|---|---|---|
| Zambia | Its $1.5 billion deal is not yet signed, the data terms are being rewritten, and it has ratified the African Union treaty on personal data. | Source (opens in a new tab) |
| Rwanda | Its 25-year deal allows "any data", while its own law requires personal data to be stored in Rwanda. | Source (opens in a new tab) |
| Nigeria | It has the largest African deal, $5.05 billion, with unclear protections for patient data. | Source (opens in a new tab) |
| Ghana | It turned down a deal over data and has ratified the African Union treaty on personal data. | Source (opens in a new tab) |
Has this worked before?
In 2007 Indonesia stopped sending bird flu samples to WHO, after learning that drug companies had used its samples without permission. Four years later, WHO members agreed a framework that ties access to flu samples to a fair share of the vaccines made from them. One country's refusal changed a global rule. Source (opens in a new tab)
Global Health Watch: the pandemic influenza framework
First steps
- African UnionAfrica CDC sends a draft of the rules to all 24 African signatories and to Zambia by 28 October 2026.
- Regional groupsofficials in ECOWAS, the East African Community and SADC check the draft against their data laws by 15 December 2026.
- Kenyathe Ministry of Health and the Data Protection Commissioner put the rules on the table at the first review of Kenya's deal, by 31 January 2027.
Who acts, and with what
- Who leads
- Africa CDC with the African Union Commission; Kenya as the first country to use the rules
- Instrument
- A model set of rules issued by Africa CDC, endorsed by African health ministers and free for any government to use
- How progress is checked
- A draft by 28 October 2026, endorsement by February 2027, and ten countries using it at their next review
- Signal to change course
- New or renewed deals are signed on the old terms
- What stands in the way
- Governments need the money and may fear delays. The United States may refuse to change the terms.
- Cost and money
- No budget has been published. The drafting can be done by lawyers already employed at the African Union, Africa CDC and national data regulators.
Who else contributes
| Who | Contribution |
|---|---|
| Kenya's Ministry of Health | Uses the rules first and reports what happens |
| National data protection regulators | Check the rules against national law |
| ECOWAS, the East African Community and SADC | Match the rules to regional data laws |
| African negotiators at WHO in Geneva | Bring the same rules into the global talks |
| African research institutes | Advise on fair terms for genetic research |
What each audience can do
Governments
What you can doAdd the rules to your deal at its next review
What you gainHealth money without losing control of your data
AU and regional bodies
What you can doEndorse the rules at the AU summit in February 2027
What you gainOne African position in place of 24
NGOs and civil society
What you can doExplain to the public what health data is shared and why
What you gainCitizens who know their rights
Researchers and media
What you can doSet fair terms for genetic studies that use African samples
What you gainFair credit and returns for African science
Business and investors
What you can doUse the same rules in contracts with African laboratories
What you gainClear legal terms
The briefings behind this
Africa CDC
The African Union's public health agency, based in Addis Ababa. It coordinates disease control across the continent.
Health briefingGlossarySource: africacdc.org (opens in a new tab)
African Union (AU)
The organisation of 55 African states, based in Addis Ababa. Its heads of state meet each February. It can suspend members after a coup.
World Health Organization (WHO)
The UN's health agency. It sets health standards and coordinates responses to outbreaks. The United States left it in January 2026.
Pathogen sharing and benefit-sharing
Pathogens are viruses and bacteria. Countries that share samples and genetic data on them want a fair share of the vaccines and medicines made from them. This is called benefit-sharing.
World Health Assembly
The yearly meeting of all WHO members, held in Geneva each May.
African Union Commission
The African Union's secretariat. It prepares decisions for heads of state and carries them out.
ECOWAS
The Economic Community of West African States. Mali, Burkina Faso and Niger left it in January 2025.
East African Community
A bloc of eastern and central African states, including Kenya, Uganda, Tanzania, Rwanda, Burundi and the Democratic Republic of the Congo.
SADC
The Southern African Development Community, 16 states from the Democratic Republic of the Congo to South Africa.
Data protection law
A law that sets rules on collecting, storing and sharing personal information, usually enforced by a national regulator.
Words used on this page
- Africa CDC
- The African Union's public health agency, based in Addis Ababa. It coordinates disease control across the continent. Health briefing · Glossary · Source: africacdc.org
- African Union (AU)
- The organisation of 55 African states, based in Addis Ababa. Its heads of state meet each February. It can suspend members after a coup. Glossary · Source: au.int
- World Health Organization (WHO)
- The UN's health agency. It sets health standards and coordinates responses to outbreaks. The United States left it in January 2026. Health briefing · Glossary · Source: who.int
- Pathogen sharing and benefit-sharing
- Pathogens are viruses and bacteria. Countries that share samples and genetic data on them want a fair share of the vaccines and medicines made from them. This is called benefit-sharing. Health briefing · Glossary
- World Health Assembly
- The yearly meeting of all WHO members, held in Geneva each May. Health briefing · Glossary
- African Union Commission
- The African Union's secretariat. It prepares decisions for heads of state and carries them out. Glossary
- ECOWAS
- The Economic Community of West African States. Mali, Burkina Faso and Niger left it in January 2025. Politics and governance briefing · Glossary
- East African Community
- A bloc of eastern and central African states, including Kenya, Uganda, Tanzania, Rwanda, Burundi and the Democratic Republic of the Congo. Glossary
- SADC
- The Southern African Development Community, 16 states from the Democratic Republic of the Congo to South Africa. Glossary · Source: sadc.int
- Data protection law
- A law that sets rules on collecting, storing and sharing personal information, usually enforced by a national regulator. AI and technology briefing · Glossary