Privacy Map

Ethiopia. Comprehensive data protection. Proclamation

PDPPPersonal Data Protection Proclamation No. 1321/2024

In force
Partly verifiedMedium confidence. Penalty figures from secondary sources and not fully reconciled.

§1Summary

Synopsis

Ethiopia's first comprehensive data protection law, assigning supervision to the Ethiopian Communications Authority. It introduces principles, rights, DPO and breach duties and restricts transfers abroad.

Key themes
  • registration/licensing
  • DPO
  • breach notification
  • data sovereignty
  • cross-border transfers
  • criminal penalties
Unique features

Controllers and processors must be registered with and licensed by the ECA. 'Data sovereignty' is listed as a processing principle, and unlawful cross-border transfer or sale of personal data carries up to 10 years' imprisonment.

SaaS relevance

A SaaS provider processing Ethiopian personal data needs ECA registration/licensing and must justify transfers out of Ethiopia.

§2Obligations

Extraterritorial
Limited
Breach notification
ECA within 72h; data subjects in some cases
DPO
Conditional
Cross-border transfers
Adequate jurisdictions; otherwise ECA authorisation plus consent
Maximum penalty
Up to 4% of annual turnover for institutions; up to ETB 600,000 and/or 10 years for individuals

§3Dates

Key dates
  • Adopted
  • In force
  • Approved by parliament 2024-04-04; published in Federal Negarit Gazette 2024-07-24; implementing transfer regulation reported

§4Text and authority

Text
Authority
Ethiopian Communications Authority (ECA)

§5Where it applies

Domestic law of
Ethiopia

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Penalty figures from secondary sources and not fully reconciled.