What do Data Rights mean for you?

This is the second piece in a five-part series from the Sudan Centre for Policy Studies on why privacy laws are vital in the digital age.

Consider an ordinary morning for a twenty-five-year-old in Khartoum. Call him Zubeir. He is a typical Sudanese internet user. He checks his balance on the Bankak app, scrolls through social media, uses an AI chat tool to help draft a message, shops on online stores, and posts a few photographs from the day before. At some point he notices an advertisement for a product he mentioned aloud but never searched for. None of this is simply what using the internet looks like in Sudan in 2026.

Every one of those interactions generates data about him, and in Sudan no law governs how that data is collected, held, or used. The first piece in this series examined that gap as a matter of national security and data sovereignty, arguing that a country which cannot govern where its citizens’ data lives cannot fully govern itself. This piece turns to a connected question: what a data protection law would mean for the ordinary Sudanese citizen, both as a consumer who deserves protection and as a citizen of an economy that is currently giving away the value of its own data for free. Understood this way, data rights are not only a shield against harm. They are also a form of economic self-determination.

The Consent That Was Never Given

Begin with the most basic promise the digital economy makes to its users: that they agree to what is done with their data. In practice, that agreement is largely an illusion, and it is an illusion by design.

The tools that manufacture it have a name: dark patterns. These are screens and buttons deliberately designed to trick people into choices they would not otherwise make, nudging them to hand over more than they intended in favour of the company rather than themselves (Brignull, 2020). They are not accidents; they are carefully built, and the evidence shows they work. In one controlled experiment, simply changing an “Accept or Decline” choice into “Accept and continue (recommended),” set against a fainter “Other options” and pre-selected in the company’s favour, nearly doubled the number of people who agreed (Luguri and Strahilevitz, 2021). The design of the screen, not the value of the offer, decided what people chose.

This matters most where the stakes are highest. Millions of Sudanese now run their financial lives through Bankak, the Bank of Khartoum’s app and the most widely used banking platform in the country. Many of the apps people rely on were built for other markets and work mainly in English, a language not every user reads easily. When a consent screen is already designed to hide its meaning, and is then shown in a second language to people who have only recently come online, the “agreement” it collects is meaningless. An app that holds a person’s salary, savings, and full record of transactions is exactly the kind of service where clear, understandable consent should not be optional, yet no law today requires that the terms be shown plainly, in Arabic, in a form an ordinary user can actually judge. The Malabo Convention, which Sudan has already signed and which the first piece examined in detail, makes consent the first principle governing personal data (African Union, 2014). A domestic law giving that principle force would require consent to be informed and freely given, in words people understand, with saying no made no harder than saying yes. That is not a technicality. It is the difference between a citizen who has agreed to something and one who was simply steered into it.

The Profile You Cannot See

Consent is only the entry point. The deeper problem is what happens to the data after it is collected, and here the machinery is almost completely hidden from the user.

Much of the data gathered about a person is collected not by the app they are using, but by outside code quietly embedded inside it: small pieces of software from other companies, added for advertising and tracking (Egelman et al., 2017). This code follows users from one app or website to the next, stitching together a detailed and lasting profile, usually without the person knowing. You can delete an app, but you cannot delete the tracking that has already followed you across everything else you use.

That profile is the raw material of targeted advertising: companies track what a person searches, reads, watches, and buys, build a model of them, and sell access to it to advertisers (Acquisti, Mustri and Nie, 2022). This is the real reason an advertisement can seem to know what you were just thinking. The unease this creates is widely shared: a large survey found that most people are worried about how companies use their data and feel they have little or no control over it (Pew Research Center, 2023). Most of the careful research on these harms comes, unavoidably, from the United States and Europe, where they have been studied for years; the near-total absence of comparable Sudanese data is not a sign that the harm is absent here, but a direct result of the very gap this series describes. The tools are built into the platforms Sudanese people use, not into any one country.

The stakes go beyond shopping. The same targeting machinery can be turned to politics: research measuring the persuasive power of political targeting found that, in at least one experiment, a targeted strategy outperformed other messaging by seventy per cent or more, though the researchers stress there is real debate about how large this effect is in practice (Tappin, Wittenberg et al., 2023). In a country living through conflict and political transition, the ability to sort citizens by where they are, what they believe, and how they behave, and then target them accordingly, is not a hypothetical concern.

A data protection law answers this directly, by giving citizens rights they simply do not have today. The right of access would let a person see what is held about them. The right to erasure, set out in the Malabo Convention, would let them demand that their profile be deleted, not merely paused (African Union, 2014). And limits on the targeting of sensitive matters, such as health, religion, and political views, would put some uses of personal data beyond commercial reach altogether. These are the concrete tools that let an ordinary person take back some control over information that is currently gathered, traded, and used entirely without their knowledge. (The next piece in this series turns to a further harm that grows from this same data: the way platforms are designed to capture and hold our attention, and the wider dangers of being online.)

Whose Data, Whose Economy?

Up to this point the argument has been about protection: shielding people from manipulation, surveillance, and engineered compulsion. But the more far-reaching point is that the same unregulated flow of data that harms people as consumers also shapes the economy around them, and not in their favour. This is where data rights become a question of economic self-determination.

Consider why there is no Sudanese alternative to the foreign platforms people depend on. The dominance of the biggest technology companies rests largely on a data advantage: the sheer volume of user data they control, combined with the pull of a large existing user base, builds walls that local newcomers cannot climb (López González and others, 2024, drawing on the World Bank Global Digital Antitrust Database). A new Sudanese platform cannot match the accumulated data of a company that has been gathering users worldwide for years, so it cannot match the service, so it cannot attract the users that would let it build its own data. The cycle feeds itself.

This has a name in the development literature: data colonialism, the extraction of raw personal data from the countries of the Global South in a way that creates dependence on a handful of global platforms and blocks local innovators from competing (López González and others, 2024; UNCTAD, 2021). For a country like Sudan, the result is that local start-ups are pushed aside, and both the data and the profits it generates flow out of the country instead of being reinvested in it. Sudanese data has value. Under current conditions, almost none of that value stays in Sudan.

South Korea shows what a different approach can achieve, and what it costs. For nearly two decades, South Korea treated its detailed mapping data as a national asset and restricted sending it to servers abroad, which meant the globally dominant Google Maps could not offer full navigation in the country. In the space this protected, local companies flourished: by early 2026 the local service Naver Map led the market with about 26.5 million monthly users and roughly seventy per cent share, while Google Maps trailed far behind (Korea Herald, 2026a). A study presented in February 2026 estimated that exporting the data without strong safeguards could cost the economy as much as 136 billion dollars over ten years, much of it through mapping fees that local developers now pay to domestic firms rather than foreign ones (Korea Herald, 2026b).

The case also shows the pressure such policies attract, the same pressure Sudan should expect. In February 2026, after nearly two decades of refusal, South Korea gave conditional approval to export the data under strict security conditions, ending a long-running trade dispute with Washington, which had labelled the restrictions an unfair barrier protecting local firms (Korea Times, 2026). Here was a state using control over data to build a domestic industry, then being pushed by a foreign power to give that control up. India did something similar in 2016, banning Facebook’s Free Basics and treating data flows as a matter of sovereignty, rejecting a model that would have locked citizens inside a single foreign platform (López González and others, 2024). In each case the recognition was the same: whoever controls the data controls the economy built on top of it.

The implication for Sudan is that data rights are not only consumer protection. They are also industrial policy. A law that keeps sensitive data inside the country and gives citizens control over it also creates the conditions in which Sudanese innovation might emerge, much as South Korea’s restrictions created room for Naver. This is why data protection should go hand in hand with real competition safeguards, rather than being pursued on its own.

That this is not a distant or theoretical concern was shown in Sudan itself in July 2026. The Central Bank of Sudan revoked a licence it had recently granted to a young company, Al-Asjad Smart and Digital Solutions, to run an electronic payments platform, only days after the company launched. The decision followed public controversy over how a firm so new to so complex a field had been licensed at all, amid questions about its financial soundness and outside affiliations, and the Central Bank then formed an emergency committee to review all future applications to run payment systems (Sudan Tribune, 2026; Tag Press, 2026). It shows exactly the risk that the absence of a proper framework creates: sensitive financial infrastructure, and the citizen data flowing through it, handed to inexperienced firms relying on imported servers, without the legal safeguards a data protection regime would require. As the only other available Sudanese commentary on this subject has argued, this legislative vacuum has itself made it easier to hand out licences over sensitive infrastructure with too little restraint (Mohamed Ahmed, 2026).

The case for such a law must still face the strongest objections honestly, and three are serious. First, that rules requiring data to be stored locally could push away the foreign services Sudan does have, or raise costs a fragile economy can ill afford. Second, that a state facing conflict and limited capacity cannot realistically enforce rights like access and erasure. Third, that targeted advertising is what makes so many services free, so restricting it may raise the cost of digital life for those who can least afford it. Each has force, but none is decisive. Local-storage rules can be applied first to the most sensitive data, such as financial and government records, rather than to everything at once, and the South Korean experience suggests they can attract local investment as much as repel foreign firms. The enforcement worry is a reason to move in stages and build capacity deliberately, as the first piece argued, not a reason to leave citizens unprotected in the meantime; a partial law consistently enforced is worth more than a comprehensive one that exists only on paper. And the claim that surveillance advertising pays for free services ignores that gentler, consent-based advertising remains entirely possible. The choice is not between free services and paid ones, but between services that respect a citizen’s control over their data and services that do not.

Beyond Data Protection

It is worth being clear about the limits of what a data protection law can do, because overstating its reach would weaken an otherwise strong case. One harm sits at the edge of data protection and belongs partly to another area of law. When the photographs, writing, and other material that ordinary people post publicly, and, more seriously, the work of Sudanese journalists, photographers, artists, and researchers, are collected to train AI systems without knowledge, consent, or payment, the injury is in large part a matter of copyright rather than of personal data. These are separate areas of law, and blurring them helps no one.

The copyright question is being fought hard elsewhere, and reached a landmark in 2026. In one case, a United States court gave final approval in July 2026 to a 1.5 billion dollar settlement, the largest copyright class settlement in American history, over claims that an AI company had trained its systems on hundreds of thousands of books taken from pirate libraries, at roughly three thousand dollars for each of some five hundred thousand works (Bloomberg Law, 2026; Authors Guild, 2026). It treated training on lawfully bought works as potentially acceptable but training on knowingly pirated material as not, though as a single lower-court decision it set no binding rule for the future (Tech Times, 2026). The wider industry has begun moving from scraping first to seeking licences, guidance from the United States Copyright Office in 2025 pointed the same way, and international bodies including the World Intellectual Property Organization now acknowledge that existing frameworks are strained by AI training (US Copyright Office, 2025; WIPO, 2024).

The lesson for Sudan is not to import these battles wholesale. The dominant international response to AI and copyright is being shaped around the interests of large Western rights-holders, and a treaty built for those interests would do little for a Sudanese photographer whose work is scraped from a public account. The principle that guided the first piece applies here too: Sudan should design protections around the interests of its own citizens and creators, rather than signing onto systems built elsewhere and for others, approaching Western-oriented intellectual property treaties with caution, and treating the protection of Sudanese creative work as a problem to be solved in Sudan’s own interest.

Conclusion: A Task for Society, Not Only for Legislators

A data protection law would not solve all of this at once, and it would not do it alone; some of these harms need competition law, and others need a modernised approach to copyright. But at its heart is a simple shift in who holds control. It would mean that a citizen agrees to what is done with their data knowingly rather than by manipulation, that they can see and erase the profile built from their behaviour, that the data used to hold their attention cannot be hoarded for that purpose, that Sudanese data might build Sudanese industry rather than only enrich firms abroad, and that the work of Sudanese creators is protected with them in mind.

Yet it would be a mistake to end on the law alone, because a law is only ever as strong as the society that enforces and understands it. A law that is passed and then left unenforced is only paper; enforcement depends both on institutions with the power to act and on a public that knows enough to demand it. That means an independent regulator with real powers, able to investigate complaints, examine how companies handle data, and impose penalties heavy enough to deter, rather than a body that exists only on paper. The first piece noted that Sudan created new digital authorities by decree in late 2025; the task now is to give them real teeth rather than a name. This is not a uniquely Sudanese difficulty. Across Africa, the gap between passing digital and data laws and actually enforcing them remains one of the central obstacles to protecting people online, and Sudan would be building its framework into that same regional reality.

Laws and institutions are necessary, but they are not enough. What must go with them is a genuine effort to raise public awareness of internet and technology issues, so that understanding one’s digital rights becomes a basic part of modern citizenship rather than a specialist concern. This does not have to wait for the state. Civil society groups, universities, journalists, and technology professionals, including the many Sudanese abroad with expertise in these fields, can begin now: by translating digital-rights ideas into plain Arabic, by bringing basic digital literacy into schools and community programmes, by covering data and technology in the national press, and by pressing for whatever protections are passed to be enforced. A policy research institution like this one has its own part in shaping that conversation. The responsibility does not rest with legislators alone.

The first piece in this series asked who controls Sudan’s data at the level of the state. This piece has asked a closer, more personal question: who controls the data of the ordinary citizen. Today, the answer is that they do not. A well-designed data protection law, paired with competition safeguards, a locally minded approach to intellectual property, real enforcement, and a broad effort to build public awareness, is how that changes. This is a problem Sudanese must take up as a society, and for themselves, because no outside framework will do it for them. Privacy, in the end, is not merely the right to be left alone. It is the foundation of a citizen’s control over their own digital life, and of the economy increasingly built upon it.