Data Protection Act 2023 (Law No. 005)

What is the law?

The Data Protection Act, Law No. 005 of 2023, sets rules for how organisations collect and use information about people in Somalia. It is Somalia's first comprehensive data protection law (Wikipedia, Data Protection Act, 2023). It has 43 articles in nine chapters (text of the Act, via Data Protection Africa).

• Signed: sources give 21 or 22 March 2023 (Wikipedia; Digital Policy Alert).
• In force: 23 March 2023, across Somalia (DataGuidance).
• Regulator: the Data Protection Authority, launched in February 2024. See Data Protection Authority.

Who does it cover?

Under Article 4, the law applies to any "data controller" that (text of the Act):

1. is based or operating in Somalia;
2. processes data inside Somalia; or
3. monitors people in Somalia or offers them goods or services.

What it does not cover (Article 5): personal and household use; police and court work on crime; public health emergencies; national security; and journalism, teaching, art and literature where the rules would clash with those purposes (same source). Smaller controllers had two years before most rules applied to them.

What rights does it give people?

Chapter IV gives each person ("data subject") these rights (text of the Act):

• To know and get a copy of personal data an organisation holds, and where it came from, free of charge (Article 20).
• To correct wrong, out-of-date or misleading data, or to delete it (Article 20).
• To withdraw consent (Article 21).
• To object to processing (Article 22).
• Not to be judged only by a machine: not to face a decision based only on automated processing (Article 23).

Children (Article 16): consent must come from a parent or guardian. For online services, a child aged 16 or over can consent for themselves (same source).

What must organisations do?

(text of the Act)

• Have a lawful reason for processing, collect only what is needed, keep it no longer than needed and keep it accurate (Articles 14 and 15).
• Tell people what they collect and why (Article 18).
• Keep data secure (Article 24).
• Report breaches within 72 hours to the Authority when a breach risks harming people (Article 25), and keep records of breaches (Article 27).
• Assess risk before high-risk processing (Article 29).
• Limit transfers abroad to countries or bodies with adequate protection, or with other safeguards (Articles 30 and 31).
• Register: "data controllers of major importance" must register with the Authority within six months, and name a data protection officer (Articles 32 to 34).

What are the penalties?

• Complaints and orders: the Authority hears complaints, investigates and can issue orders (Articles 35 to 37).
• Failing to obey an order is an offence. In the text published by Data Protection Africa, the fine is written as "[US one million dollars]" and the prison term as "[two] years", both in square brackets (text of the Act, Article 38).
• Appeal: anyone unhappy with an order can ask the Supreme Court to review it within 30 days (Article 39).
• Damages: a person harmed, or a consumer group for them, can sue the organisation in court (Article 40).

How has it been put into practice?

Reviews by the Strathmore University CIPIT centre and TechHive Advisory describe the Act as based on international models and discuss its regulations (CIPIT, Strathmore University; TechHive Advisory). In 2026 the Authority began registering banks, telecoms, hospitals, NGOs and government offices, and trained public and private bodies on the law (Dawan Africa; Dawan Africa).

Related pages

• Ministry of Communications and Technology
• Somali national ID (NIRA)