Skip to main content

DPIA — Africa's Talking (SMS)

Provider: Africa's Talking Limited Service: Bulk SMS via api.africastalking.com Contract owner: ZFA InsureLink (data controller) DPIA owner: DPO Last review: 2026-07-16

What data is transferred​

FieldPurposeRetention at provider
Recipient MSISDN (E.164 phone number)SMS routingConfigurable; default 6 months in delivery-reports API
Message body (plaintext, up to 160/1600 chars)Message content30 days in delivery-reports API
Sender IDBrandingPermanent (registration record)
Timestamp + message idDelivery reconciliation6 months

Where the data goes​

Africa's Talking terminates SMS traffic through carrier interconnects in Nairobi, Kenya. Every message routed via this provider is a cross-border personal-data transfer per DPPA §16.

DPPA §16 permits cross-border transfer when the data subject consents after being informed. ZFA relies on:

  1. Explicit acknowledgement recorded per user/client in the DataTransferConsent table (transferKind = sms_kenya).
  2. Transactional carve-out (§13 legal-obligation) for auth / compliance / system category messages — OTP, MFA, password reset, SAR alerts, breach notifications, statutory notices.

The dispatch layer enforces this: an SMS for a non-transactional category is skipped if the consent row is missing.

Safeguards​

  • HTTPS transport (TLS 1.2+); AT enforces on their side.
  • API key rotated via AT_API_KEY env; kept in the platform's secrets store, never checked in.
  • HMAC-SHA1 signature on delivery webhooks (AT_WEBHOOK_SECRET); timing-safe compare in provider-webhooks.controller.ts.
  • STOP replies from recipient → automatic preference flip to enabled=false across all non-transactional categories.

Data-subject rights routing​

  • Access request (DPPA §17(1)): DPO exports the recipient's Notification rows filtered by channel=sms. Message bodies are decrypted (Phase 1 AES-256-GCM) only under NotificationPii permission.
  • Rectification (§17(3)): if a wrong phone number was used, DPO updates User/Client and adds a note to the affected notifications.
  • Erasure (§17(5)): DPO issues DELETE via the DSAR module; Notification rows soft-delete via the existing retention job. Provider-side deletion runs on AT's 30-day / 6-month schedules; DPO records the request date for the audit trail.
  • Objection (§20): STOP reply OR POST /notification-preferences/me/data-transfer/withdraw (transferKind=sms_kenya).

Residual risks​

  • Provider retention — AT keeps delivery reports 6 months by default. A subject-erasure request cannot compel AT to purge within Uganda's 30-day statutory window; the platform records the request timestamp and the AT deletion SLA in the erasure audit event.
  • Carrier logs — MTN / Airtel Uganda receive the delivered SMS and keep call-data-records under Uganda Communications Act 2013 interception regime. Out of ZFA's control.

Review cadence​

Annual, or on:

  • Provider contract change
  • New endpoint / region routing
  • Regulator query