Navigating Gaps in Governance and Capacity for Equitable and Responsible Data Sharing in Health Research in Sub-Saharan Africa: A Literature Review

3.1 Key partners

Key partners in global health research in SSA play an integral role in the generation, management, analysis and use of health data. The contributions of these actors are particularly significant during public health crises when timely access to accurate and ethically generated data is essential for effective response and decision-making. Amongst these key partners are multilateral organisations such as the WHO Regional Office for Africa (WHO AFRO), which generates intelligence on diseases at regional and global levels (Edelstein et al., 2018; One Health High-Level Expert Panel et al., 2023). Regional institutions, such as the African Centres for Disease Control and Prevention (Africa CDC) and the European and Developing Countries Clinical Trials Partnership (EDCTP), have also played important roles in strengthening outbreak preparedness and research capacity in SSA (Nyirenda, Bockarie and Machingaidze, 2021). At the national level, public health agencies, such as the Nigeria Centre for Disease Control (NCDC) and the National Institute for Communicable Diseases (NICD) in South Africa, coordinate disease surveillance and public health responses during emergencies such as the COVID-19 pandemic. Their responsibilities include contact tracing, quarantine enforcement and the aggregation and analysis of clinical data to inform national policy (Ekong, Chukwu and Chukwu, 2020). Their capacity to manage large-scale data operations and generate actionable insights highlights the importance of institutional robustness and regulatory preparedness in health emergencies.

Private sector actors, particularly mobile network operators (MNOs), have become increasingly significant in this ecosystem, as they control digital infrastructures through which highly valuable forms of mobility, location, subscriber traffic and call record data are generated and managed. These data may subsequently be repurposed for epidemiology, surveillance, public health planning or commercial analytics (Gilbert, Adekanmbi and Harrison, 2021; Klaaren et al., 2020; ODPC Kenya, 2023; Rennie et al., 2023). In contexts where Call Detail Records (CDRs) are requested, shared, or analysed for research or public health purposes, MNOs can shape governance outcomes in decisive ways: they may determine whether data remain in-house, are disclosed as raw records or aggregated outputs, or are analysed through third-party processor arrangements. They may also influence which public or research actors gain access, what contractual and security safeguards apply, and whether cloud storage or cross-border transfers occur (ODPC Kenya, 2023). In practice, therefore, MNOs may function as data controllers, processors, or custodians at crucial points in the data-sharing chain.

The growing use of CDRs in research and public health also raises critical governance concerns. These include privacy intrusion, the risk of re-identification through data linkage, the lack of meaningful consent for passively generated data, bias arising from uneven phone ownership and network coverage, the secondary use of telecommunications data beyond its original purpose, and fragmented oversight across telecommunications, health, ethics and data protection institutions (de Montjoye et al., 2013; Edgcumbe and Thaldar, 2025; Klaaren et al., 2020; ODPC Kenya, 2025). These concerns become even more pronounced when CDRs are shared across borders with foreign collaborators or stored in clouds where questions of lawful transfer, applicable safeguards, consent, accountability and regulatory oversight become more complex. As discussed further in Section 3.3, Kenya, Nigeria, Rwanda and South Africa govern cross-border data transfers through differing legal frameworks that vary in the strictness of their safeguards, consent requirements and adequacy-type protections, while also reflecting uneven regulatory capacity and continuing uncertainty over how such protections should be assessed and enforced in practice (Kabanda et al., 2023; Nienaber McKay et al., 2024; Staunton et al., 2025; Waithira, Mutinda and Cheah, 2019).

These governance challenges become clearer when viewed through specific country-level examples, which illustrate both the utility of MNO-held data and the legal, ethical and institutional complexity surrounding their use. In Kenya, malaria research using mobility data derived from Safaricom demonstrated the epidemiological value of such data, while also exposing risks relating to secondary use, re-identification, and public trust (de Montjoye et al., 2013; Wesolowski et al., 2012). In Nigeria, MTN’s COVID-19 analytics showed how regulatory approval processes, aggregation practices and stakeholder management shape what counts as governable use of telecommunications data (Gilbert, Adekanmbi and Harrison, 2021). In South Africa, the COVID-19 Tracing Database demonstrated that emergency access to operator-held location data can be formally structured but also raised acute concerns about rights protection and surveillance overreach (Klaaren et al., 2020; Viljoen et al., 2020). In Rwanda, the legal framework illustrates how localisation requirements, transfer contracts and supervisory authorisation are likely to shape the governance of future uses of operator-held mobility data (NISR, 2025). Across these contexts, the central governance issue is not simply whether MNO data can be used, but under what legal, ethical and institutional conditions such use becomes accountable, proportionate and publicly legitimate. The most promising response therefore lies in explicitly situating MNOs within data governance frameworks as actors whose responsibilities must be defined through law, regulatory guidance, data transfer agreements and research-specific oversight.

By virtue of managing data, MNOs are required to comply with national data protection laws. Nevertheless, the regulatory environment for MNOs remains underdeveloped. As Raza et al. (2018: p. 14) observe, ‘countries are adopting a range of approaches to data privacy and ownership, exposing MNOs to legal uncertainty’, thereby creating an unpredictable governance landscape. Moreover, MNOs must adhere to diverse regulatory frameworks, each imposing different standards for data management, enforcement and penalties (Collins, Hamza and Eweje, 2024). This challenge is exacerbated by the global nature of telecom networks, where data routinely crosses borders and falls under multiple legal jurisdictions. As a result, MNOs face significant difficulties in developing coherent, cross-jurisdictional governance strategies that can be applied consistently across operations (Collins, Hamza and Eweje, 2024). These dynamics underscore the urgent need for regulatory harmonisation to enable MNOs to function effectively as enablers of public health while safeguarding fundamental rights, including privacy and autonomy.

At the core of the health data ecosystem are also researchers and scientists whose roles extend beyond data collection and analysis (Soucie, 2012). Disease-specific forums, such as Knowledge Integration for Tuberculosis Therapeutics (KITT), also enable knowledge sharing and collaboration based on newly established data-sharing procedures (Schildkraut, Sloan and Boeree, 2024). Researchers and scientists are central to the design, execution and translation of research that informs both national and regional health policies. Through the ethical and systematic collection, management and interpretation of health data, they contribute to surveillance, policy formulation, clinical intervention and public health planning. Kabanda et al. (2023) underscore their importance in navigating the structural and ethical complexities of the health data environment in SSA. Their engagement with multiple stakeholders, including funders, governments, communities and regulatory bodies, positions them as key facilitators of interdisciplinary and cross-sectoral collaboration. At the same time, the growing volume and sophistication of health data, particularly in the context of digital health technologies, big data and collaborative research, make sustained investment in research capacity and technical infrastructure increasingly necessary. Their high-level role thus underscores the urgent need for comprehensive capacity-building initiatives to ensure that African researchers are equipped with the necessary skills, tools and institutional support to lead data-driven health research that is both locally responsive and globally relevant.

International actors such as research funders and journal publishers also play a critical role in shaping the health research landscape in SSA. Funders such as the National Institutes of Health (NIH), the Wellcome Trust, and the Gates Foundation have contributed significantly to research capacity development and the visibility of African-led research (Obiora et al., 2022). However, their influence also raises important questions about equitable data sharing and the fair distribution of research benefits. Skelly and Chiware (2022) call for clearer policy frameworks to define the responsibilities of international actors and to ensure that African data serves regional priorities. These concerns are intensified by global power asymmetries in data sharing, as demonstrated by the punitive travel bans imposed on South Africa following its early disclosure of the Omicron variant, a response that contradicted principles of solidarity and exposed geopolitical inequities in global health governance (Silva and Smith, 2023). In response, Silva and Smith advocate for a reciprocity-based approach to data sharing, whereby mutual benefit and equitable treatment replace idealistic but unfulfilled notions of solidarity. Collectively, these dynamics underscore the need for governance frameworks that support collaboration while safeguarding equity, reciprocity and regional autonomy in global health research.

3.2 Capacity and skills gap

Some of the identified challenges relate to persistent capacity and skills gaps that hinder effective data sharing in health research across SSA. A major barrier lies in the disparity between primary data producers and secondary data users, particularly regarding data management capacity and systems (Bull et al., 2015; Cengiz, Kabanda and Moodley, 2024; Ndembi, Mekonen and Folayan, 2024). Significant differences in expertise, resources and institutional support not only hinder the implementation of data-sharing policies (Bull et al., 2015) but also complicate the monitoring and evaluation of compliance with agreed terms of data transfer (Cengiz, Kabanda and Moodley, 2024), further compounding the challenge. Without adequate skills and resources for data curation and management, ensuring standardisation and maintaining the quality of shared data becomes difficult, which in turn undermines efforts for collaborative research (Brand et al., 2022). The skills shortage in health research is exacerbated by ongoing brain drain, which has led to the emigration of trained personnel and the weakening of national research systems (Adebisi, Rabe and Lucero-Prisno, 2021). In addition, many researchers lack formal training in data stewardship, which limits their ability to handle complex datasets or adopt open science practices (Tenopir et al., 2011). Institutional cultures that fail to prioritise or incentivise data sharing make it more difficult to improve data management and sharing practices. As Bangani and Moyo (2019) observe, even in well-resourced settings like South Africa, researchers are often reluctant to share data due to infrastructural limitations and a lack of institutional support.

These capacity and skills gaps are deeply rooted in chronic underinvestment in research infrastructure and human resource development, which continues to undermine the region’s ability to generate, manage and utilise high-quality health data. As Pisani, Ghataure and Merson (2018) observe, large-scale data collection efforts are often limited by inadequate financial and technical resources, resulting in fragmented and unsustainable research initiatives. Kabanda et al. (2023) further argue that limited investment in universities and research institutions, combined with weak training and mentorship structures, erodes the foundation for building a resilient and skilled research workforce. This is echoed by Izugbara, Kabiru and Amendah (2017), who point to structural weaknesses that constrain knowledge production and innovation, which hinder the region’s ability to generate and utilise health data effectively. Problems such as unstable electricity and poor internet connectivity, particularly in rural and under-resourced settings, disrupt research workflows and access to data repositories (Bezuidenhout, 2019). As a result, many institutions across SSA lack the capacity to manage and preserve datasets beyond the lifecycle of individual projects (Kabanda et al., 2023; Tenopir et al., 2011). Therefore, these infrastructural challenges and human resource constraints compromise data sharing, long-term data stewardship and research continuity.

Addressing these disparities requires targeted investment in capacity building, including the integration of data management into research training curricula and the development of supportive institutional policies. As the use of big data in health research expands, SSA researchers must be equipped with relevant technical competencies to contribute meaningfully to the global scientific community. The COVID-19 pandemic exposed the consequences of capacity gaps in terms of lack of adequate resources; in Nigeria, for example, testing kit shortages led to underreported cases, illustrating how resource gaps can compromise public health responses (Ekong, Chukwu and Chukwu, 2020). For a more equitable and productive research ecosystem, sustained funding and structural reform are essential to institutionalise open science practices and support local researchers in generating and sharing knowledge (Okafor et al., 2022).

3.3 Data governance policies and processes

Policies and processes that enable researchers to honour obligations to research participants are essential for ensuring ethical data sharing (Bull et al., 2015). In SSA, however, diverse legal regimes governing data protection often result in cross-border data transfers being evaluated on a case-by-case basis and according to different criteria (Brand et al., 2022). Article 14(6) of the African Union’s Cyber Security and Personal Data Protection Convention (African Union, 2014 (Malabo Convention)). prohibits the transfer of personal data to non-member states of the African Union, unless the receiving non-member state ‘ensures an adequate level of protection of privacy, freedoms, and fundamental rights’ of the data subjects. However, out of the four case study countries, only Rwanda is a signatory to the Convention (Transform Health, 2024b; African Union, 2026). South Africa and Nigeria signed the Convention but have not ratified it, while Kenya has not signed the Convention (African Union, 2026). Consequently, these countries have adopted different requirements for cross-border data transfer. In Kenya, Section 48 of the Data Protection Act (Kenya, 2019) prescribes stringent requirements for cross-border data transfer. These include the existence of appropriate safeguards, confirmation that the transfer of data is necessary and assurance that the receiving jurisdiction has commensurate data protection laws. The specific safeguards are set out in Section 49 of the Act (Kenya, 2019), namely obtaining the consent of the data subject, proof of effective security safeguards, or the existence of compelling legitimate interests. In contrast, the Nigeria Data Protection Act (Nigeria, 2023), read together with Regulations 2.11 and 2.12 of the Nigeria Data Protection Regulation (Nigeria, 2019), prescribes more moderate requirements for cross-border data transfer.

The Rwandan legislation is similar to the Kenyan framework. Article 8 of the Law relating to the Protection of Personal Data and Privacy (Rwanda, 2021) also prescribes strict requirements for cross-border data transfer. South Africa likewise imposes strict requirements through legislation and policy. Section 72 of the Protection of Personal Information Act (South Africa, 2013) allows cross-border data transfer subject to conditions such as adequate legal protection in the receiving country. However, because regulatory standards differ across countries and no established guidelines exist for assessing adequacy, it remains unclear how this requirement should be applied when data are shared with countries that lack clear data-sharing frameworks. The challenge is further complicated by the fact that legislation in some countries ‘does not specifically provide for cross-border transfers of personal data’, and consent requirements also vary across regions (Nienaber McKay et al., 2024: p. 17–18, 21). The problem is compounded by the continued absence, in many contexts, of robust legislative frameworks, institutional policies and data management standards (Kabanda et al., 2023; Waithira, Mutinda and Cheah, 2019). This lack of comprehensive data governance frameworks not only creates obstacles to data sharing but also raises concerns about privacy breaches and unauthorised use of personal data, especially in the context of rapidly evolving technologies such as AI systems that collect and process vast amounts of information (Nienaber McKay et al., 2024: p. 3). Moreover, it poses serious challenges for ethical research practice, which depends on comprehensive frameworks encompassing informed consent procedures, governance structures, data-sharing protocols and capacity-building initiatives to protect participants’ rights and maintain trust throughout the process.

Although regional guidelines for health information exchange exist, the framing of the guidelines leaves it up to member states to determine the scope of application to the key partners that are identified in this paper. For example, the African Union Health Information Exchange (HIE) Guidelines and Standards (2023), developed by Africa CDC, provide for the safe electronic transmission and exchange of health-related data and reports among public health institutions without a clear focus on data sharing in the health research context that involves non-public health institutions. The frameworks for health information exchange for the case study countries reflect a varying scope of application. The South African National Normative Standards Framework for Interoperability in Digital Health (South Africa 2021) only applies to systems that interact with, use data from, or upload data to a shared National Health Information System infrastructure or a shared electronic health system. The Kenyan Health Information Systems Interoperability Framework, however, applies to public and private health service providers, and obliges them to return health information reports to the Ministry of Health. Rwanda’s HIE systems also focus on sharing patient information between different public healthcare sectors (Bananeza, Uwamahoro and Basingize, 2025: p. 20), and a similar trend of focusing on the public health sector is evident in Nigeria (Mamuye, Yilma and Abdulwahab, 2022).

Following the legal and regulatory challenges outlined above, a further limitation of data governance in Africa lies in the transplantation of Western-centric frameworks without proper consideration for local contexts and value systems. For example, privacy concepts embedded in frameworks like the European Union’s General Data Protection Regulation (GDPR) are grounded largely in Western-centric individualistic understandings of rights and autonomy, which do not always align with the more relational and collective values that shape many African societies (Eke, Ochang and Adimula, 2022). Values such as solidarity, reciprocity, communal responsibility and the protection of collective dignity are particularly relevant here, as they suggest that decisions about health data are often understood not only in terms of individual choice, but also in relation to community and shared wellbeing. The absence of these values from existing data governance frameworks is therefore not merely an abstract normative concern; it has practical consequences for how consent, privacy, access and benefit sharing are organised in African research. Evidence from the region shows that data sharing is often understood through relational, rather than narrowly individualised, ethical logics. In the Kenyan context, Jao et al. (2015) show that stakeholders’ understandings of fair data sharing are closely tied to trust, community involvement and accountable governance. Similarly, Brown et al. (2024) argue that equitable data sharing in SSA is associated with reciprocity, mutual benefit and community engagement, including the fair distribution of research gains, recognition of data contributors, and meaningful benefits for local researchers and communities. Incorporating such values into governance frameworks would have important practical implications. It would support consent models that are more dialogical and community-sensitive, privacy frameworks that recognise not only individual confidentiality but also collective dignity and group-based harms, and benefit-sharing arrangements that prioritise fairness, reciprocity and local capacity strengthening. Integrating African values into data governance is therefore not about rejecting universal ethical standards, but about grounding them in the social realities of African contexts so that data-sharing frameworks become more equitable and contextually appropriate (Akpa-Inyang and Chima, 2021; Eke, Ochang and Adimula, 2022). This suggests the need for a hybrid approach to data governance in African health research, one that combines relevant international standards for privacy, accountability and data protection with African values such as reciprocity, communal responsibility and sensitivity to local social realities.

Beyond these cultural and contextual limitations, another important challenge is that legal frameworks in SSA often approach data governance too narrowly through the lens of data protection. A fuller understanding of data governance requires situating it within the broader health data ecosystem. In this ecosystem, data governance refers to the institutional, legal, procedural and technical arrangements that determine how data are collected, managed, shared and reused (Eke, Ochang and Adimula, 2022; OECD, 2022). However, governance does not operate in isolation. It interacts closely with data quality because weak governance can result in incomplete, inconsistent or poorly standardised datasets that undermine research reliability and reuse (Brand et al., 2022; Waithira, Mutinda and Cheah, 2019). It is equally tied to data security because governance frameworks establish the safeguards, access controls and responsibilities needed to prevent misuse, unauthorised access and privacy breaches (Bull et al., 2015; Nienaber McKay et al., 2024). In addition, it is linked to data stewardship, which concerns the long-term curation, preservation and responsible management of datasets, and data access, since governance determines who may access data, under what conditions and for what purposes (Kabanda et al., 2023; Waithira, Mutinda and Cheah, 2019). Framing data governance in this broader way makes it clear that responsible data sharing depends not only on privacy laws but also on the quality, security, ethical oversight, stewardship and accessibility of data across the full data lifecycle.

Seen in this broader light, an important limitation in many SSA contexts is that the enactment of data protection laws may not always translate into robust data governance frameworks. Although many countries in the region have implemented data protection legislation, these laws tend to focus mainly on privacy and security (Babalola, 2023). As Eke, Ochang and Adimula (2022) note, there is currently no national or regional institution dedicated exclusively to address data governance issues comprehensively, reflecting a wider lack of specialised institutional structures for overseeing governance beyond narrow legal compliance. As a result, other important aspects of data governance, such as data quality, integrity and usability, often remain weakly regulated or lack formal oversight altogether (Eke, Ochang and Adimula, 2022). These gaps can contribute to poor data handling and management practices. What is needed, therefore, is a more holistic approach to data governance that extends beyond privacy protection alone and addresses the full range of challenges involved in managing and sharing health data responsibly. While there is growing recognition, across the continent, of the importance of robust privacy safeguards, and efforts are underway to strengthen legal frameworks, improve awareness, and balance data protection with broader development and innovation goals, much more remains to be done to establish comprehensive and effective data governance systems across Africa.

3.4 Data sharing, governance gaps and concerns

Governance gaps in data management and sharing remain a persistent challenge in health research across SSA. Nienaber McKay et al. (2024) identify the absence of a consistent definition of ‘health data’ as a major obstacle to cross-border data sharing, creating legal uncertainty for researchers and sponsors who require clarity on the scope of the law. Data governance, broadly defined as the technical, policy, regulatory and institutional arrangements that oversee the entire data lifecycle from creation to deletion (OECD, 2022), is often inconsistently applied across the region. As noted above, although some countries, such as South Africa and Kenya, have made notable progress by enacting comprehensive data protection laws, many others continue to operate without clear or enforceable frameworks, resulting in fragmented data-sharing practices (Akintola, 2018; Bezuidenhout and Chakauya, 2018; Townsend, 2022). The lack of harmonised national and institutional policies contributes to uncertainty about researchers’ responsibilities and rights regarding data ownership, access and security. Kabanda et al. (2023) observe that such inconsistencies undermine collaborative research by discouraging researchers from making their data accessible, thereby limiting opportunities for regional and global knowledge exchange. Without strong governance structures, the potential of health data to inform public health interventions, support scientific innovation and promote equity remains unrealised.

While there has been notable progress towards data sharing within disease-specific consortia such as those focused on TB, significant challenges persist. These include delays in data sharing within the TB community (Schildkraut, Sloan and Boeree, 2024) and ongoing barriers in areas such as malaria and HIV due to weak institutional capacity (Nyirenda, Bockarie and Machingaidze, 2021), concerns of privacy breaches and confidentiality (Bull et al., 2015), and the risk of secondary use of de-identified data that can lead to stigmatisation of identifiable communities, populations or countries (Bull et al., 2015; Jao et al., 2015). Additionally, there are variations in the best practices for seeking consent to share data, such as the choice between broad or dynamic consent and the type of information to be provided (Bull et al., 2015). Moreover, challenges also emerge from sharing data based on broad consent or when data is accessed through publicly accessible platforms without seeking consent or obtaining ethics approval (Cengiz, Kabanda and Moodley, 2024). There is a need to train ethics committee members in reviewing data-sharing protocols (Cengiz, Kabanda and Moodley, 2024) since variations in practice regarding the approval of data sharing by either the ethics, scientific or data-sharing committees (Bull et al., 2015) can delay data sharing and erode trust among collaborators.

In addition, Nienaber McKay et al. (2024) note the need to consider additional safeguards and protections for cross-border transfers of health data, especially where legislation is not comprehensive, such as Data Transfer Agreements (DTAs), which could be made compulsory and negotiated before transfers of health data occur. This would, by implication, extend the scope of training required for ethics committee members.

Several interrelated concerns also continue to constrain effective data-sharing practices in SSA. A key barrier is the absence of mandatory electronic data-sharing frameworks, which not only impedes collaboration but also raises serious concerns about data privacy, ethical use and security (Kabanda et al., 2023). Even in contexts with existing data protection laws, researchers often hesitate to share their data because of concerns about privacy violations, loss of intellectual property, or being pre-empted (‘scooped’) by others (Bezuidenhout, 2019; Gomes, Pottier and Crystal-Ornelas, 2022). Institutional reluctance is often exacerbated by the lack of data management policies and guidelines, as noted by Skelly and Chiware (2022), who also call for clearer definitions of the roles and responsibilities of international funders, publishers and collaborators to ensure equitable data custodianship and sharing.

4.1 Strengthening multi-stakeholder collaboration in data-driven health research

The increasing burden of infectious diseases such as malaria, TB, COVID-19 and HIV/AIDS has catalysed the growth of international collaborative health research in SSA. National agencies, such as Nigeria’s NCDC and South Africa’s NICD, exemplify strong institutional frameworks that coordinate data-driven public health interventions (Ekong, Chukwu and Chukwu, 2020). In addition to these public institutions, mobile network operators, researchers and scientists form essential pillars of the health data ecosystem, contributing to data collection, analysis and predictive modelling (Kabanda et al., 2023; Townsend, 2022). Their collective efforts during the COVID-19 pandemic illustrate the value of cross-sectoral partnerships in producing timely, high-quality data to inform clinical and policy decision-making. However, international research funders and major publishers also wield considerable influence by enforcing data-sharing requirements as a condition for funding or publication (Obiora et al., 2022). While these mechanisms promote data accessibility, they also raise concerns around data sovereignty and equitable data ownership and sharing, particularly in a context where regulatory infrastructures are uneven across countries.

Power differentials that affect ethical and equitable data sharing and assurance of benefits to data contributors or acknowledgement of primary data collectors (Bull et al., 2015; Fernando, King and Sumathipala, 2019; Jao et al., 2015) require careful consideration. Moreover, fear of adverse effects on the research capacity, career development and reputation of early career researchers in low-resource settings when data quality is discovered to be questionable (Brand et al., 2022; Bull et al., 2015) has also been highlighted as a concern. Early data sharing before publication may undermine career prospects for early career researchers—who collected data due to the ability of high-income country researchers—to analyse and publish from the shared data faster than their early career counterparts from LMICs and institutions with less resources (Jao et al., 2015). Anane-Sarpong, Wangmo and Tanner (2020) established that researchers in Africa are likely to remain unequal as far as data sharing and governance are concerned until they receive comparable support that is like their global counterparts in their research environments.

As Nienaber McKay et al. (2024) point out, however, multi-stakeholder collaboration could be strengthened through DTAs between participating institutions to ensure joint commitment, understanding and data protection, where decisions about cross-border data transfers are concerned. In addition, the development of medical data repositories, or the use of cloud services, could be utilised and shared between institutions and countries with similar geographies and epidemiologies to facilitate collaboration (Nienaber McKay et al., 2024). This option is, however, currently limited by the lack of knowledge between countries about their counterparts’ differing legal frameworks and requirements (Nienaber McKay et al., 2024), illustrating a need for more intentional efforts by stakeholders to be better informed. Nienaber McKay et al. (2024: p. 21) suggest that this be done through ‘regular interaction, communication, and sharing of best practices between the data protection authorities’. This is achievable through intentional collaborative efforts by key stakeholders such as policymakers, researchers, funders, institutions and national agencies.

4.2 Addressing capacity and infrastructure gaps to support open science

Despite these strengths, significant weaknesses persist in the region’s capacity to support the full lifecycle of health data management. Chronic underinvestment in research institutions, limited technical infrastructure and a lack of comprehensive training programmes have hindered the region’s ability to meet the demands of data-intensive health research (Kabanda et al., 2023; Pisani, Ghataure and Merson, 2018). In many countries, researchers lack foundational skills in data stewardship, and limited organisational support often discourages engagement with open science practices (Bangani and Moyo, 2019; Tenopir et al., 2011). These limitations are especially acute in environments with unreliable internet access and frequent power disruptions (Bezuidenhout, 2019). The result is a constrained research ecosystem that limits African scientists’ participation in global knowledge production and reduces opportunities for locally relevant health innovations. To address these deficits, capacity-building efforts must include the integration of data management into research methods training, the provision of ongoing mentorship, and the establishment of institutional incentives for data sharing (Kabanda et al., 2023). Nienaber McKay et al. (2024) also suggest that African policymakers should try to understand their countries’ weaknesses to address these challenges, and that this would attract greater research investment. Additionally, regional collaboration could help pool limited resources, enabling shared access to high-quality repositories, training hubs and digital infrastructure.

4.3 Strengthening data governance for effective and equitable data sharing

More broadly, strengthening data governance in SSA requires recognising that governance is only one part of a wider data ecosystem. Effective and equitable data sharing depends on the alignment of governance frameworks with data quality standards, security safeguards, ethical oversight, stewardship capacities and fair access arrangements. Alongside capacity constraints, weaknesses in data governance frameworks continue to pose challenges to effective and ethical data sharing in SSA. While countries like South Africa and Kenya have enacted robust data protection laws, many others still lack policies that govern the ethical use, storage and sharing of sensitive health data (Akintola, 2018; Townsend, 2022). Inconsistent implementation of data governance frameworks across national and institutional levels creates uncertainties that discourage data sharing and compromise privacy protections (Bezuidenhout and Chakauya, 2018; Kabanda et al., 2023). Moreover, the absence of mandatory frameworks for electronic data sharing often results in ad hoc practices that may fail to uphold standards of transparency and accountability (Skelly and Chiware, 2022). To foster greater trust in health data systems, future policies should be contextually tailored, rights-based, and include clearly defined roles for all actors—particularly international funders and collaborators (Skelly and Chiware, 2022). Strong institutional mechanisms, such as data management plans, ethical review boards and regulated access to repositories, are vital for ensuring that data sharing is not only technically feasible but also socially just (Brand et al., 2022; Waithira, Mutinda and Cheah, 2019). Ultimately, addressing these governance gaps is essential for building a more inclusive and equitable health research environment that prioritises public trust and regional autonomy while advancing global health goals.

One of the most important consequences of weak or inconsistent governance frameworks is the erosion of trust in research collaboration. Building trust is essential for effective data sharing (Bull et al., 2015). Concerns about the future use of data (Brand et al., 2022), as well as potential misuse of shared data by recipients who may lack sufficient understanding of the data or its context, (Jao et al., 2015), can discourage researchers and communities from participating in data-sharing initiatives. These concerns are mostly significant where stakeholders fear that inadequate governance may lead to abuse of their trust. Upholding ethical principles and ensuring integrity in collaborative research are therefore crucial for building trust among researchers, research participants and their communities (Brown et al., 2024). This is supported by a survey of researchers and scientists from 43 SSA countries, which found that most were more inclined to share data on platforms where governance mechanisms were in place and data privacy could be guaranteed (Kabanda et al., 2023).

Closely connected to the question of trust is the principle of reciprocity, which is central to equitable data sharing among researchers. Reciprocity entails acknowledging data originators and research participants in ways that ensure they benefit from the sharing and reuse of data (Brown et al., 2024). Researchers are often more willing to share data with other researchers within SSA because this aligns with the expectations of strengthening local scientific capacity (Jao et al., 2015). In such contexts, reciprocity is easier to realise because data sharing can be accompanied by mutual exchange, recognition and collaboration. By contrast, the absence of reciprocity may lead data contributors to view sharing arrangements as exploitative, particularly where primary communities bear the burdens of data extraction without receiving meaningful benefits in return (Jao et al., 2015). Reciprocity is therefore not simply an ethical ideal, but a practical requirement for fairer and more sustainable data-sharing relationships.

4.4 Strengthening surveillance systems for optimal health response

Effective disease surveillance systems are crucial for timely and coordinated public health responses. Efforts to strengthen these systems have been intensified across Africa, especially in the wake of the recent public health emergencies. However, the effectiveness of surveillance systems is often limited by weak implementation, poor data quality and fragmented data-sharing structures that undermine rapid response capabilities. Several countries in SSA have made notable progress in adapting and expanding their surveillance infrastructure. In Kenya, for example, the event-based surveillance system (EBS) was adapted and scaled up in both community and health facility settings to improve the reporting of COVID-19-related signals (Ndegwa, Ngere and Makayotto, 2023). In South Africa, the National Malaria Elimination Strategic Plan (NMESP) has prioritised surveillance systems as a key strategy for the elimination of malaria, resulting in improved data availability and its integration into decision-making processes (Mabona et al., 2024). These examples illustrate how targeted investments in surveillance systems can enhance the quality and utility of health data.

However, despite progress in some countries, several others still face significant challenges. Surveillance systems remain underdeveloped, with weak monitoring and evaluation mechanisms and limited capacity for follow-up investigations. Data quality is often poor and systems lack the interoperability needed to allow for real-time data sharing between community, national and regional levels (Ndegwa, Ngere and Makayotto, 2023). Moreover, a lack of supportive supervision and inadequate training of community health workers further reduce the reliability and usability of collected data.

To address these gaps, there is a need for sustained investment in surveillance infrastructure, including the adoption of advanced digital technologies, upgradation of outdated systems and establishment of comprehensive training programmes (Fawole, Bello and Adebowale, 2023). Fawole, Bello and Adebowale (2023) further emphasise that improving health worker capacity, ensuring data quality and availability, and improving the ability to transmit surveillance data across multiple levels of the healthcare system are critical for building responsive surveillance systems. These improvements are not only essential for managing current health threats but also for preparing resilient surveillance systems capable of addressing future disease outbreaks and pandemics.