Processes personal data, in Somalia

Data Protection Act, Law No. 005 of 2023 (Federal Republic of Somalia), arts. 4-5, 14-15, 17, 19, 24, 29, 32-34 · Read the law's page

• Establish a lawful basis before processing personal data, such as the data subject's consent, the performance of a contract, a legal obligation, or the data subject having intentionally made the data public, and process it fairly and transparently.
• Collect personal data for a specified, explicit and legitimate purpose, keep it to the minimum necessary for that purpose, keep it accurate, and retain it no longer than the purpose requires.
• Where you rely on consent, be able to prove the data subject gave it.
• Keep a record of every data processor handling personal data you control, and take reasonable measures to ensure each one processes in a way that keeps you compliant.
• Implement appropriate technical and organisational measures to secure personal data, taking into account the amount and sensitivity of the data and the harm its loss or misuse would cause.
• As a data controller of major importance, carry out a data protection impact assessment before processing likely to result in a high risk to a data subject, and submit the assessment report to the Authority before you start.
• As a data controller of major importance, register with the Authority within six months of qualifying, and designate a data protection officer.

Data Protection Act, Law No. 005 of 2023, arts. 18, 20-22 (information and rights of the data subject) · Read the law's page

• Before you collect personal data, tell the data subject who you are, the basis and purposes of the processing, who you will share the data with, their rights and their right to complain to the Authority, and describe any automated decision-making and its likely consequences.
• On request, confirm whether you process a person's personal data and where it came from, give them a copy in a commonly used electronic format, and correct or delete data that is inaccurate, out of date, incomplete or misleading, at no expense and without unreasonable delay.
• Let a data subject withdraw consent as easily as they gave it, and tell them what withdrawing means.
• Stop processing personal data a data subject validly objects to, unless a public interest or other legitimate ground outweighs the unwarranted damage or distress.

Data Protection Act, Law No. 005 of 2023, arts. 2(15), 14(5) and 16 (sensitive personal data and children) · Read the law's page

• Treat biometric data, race, clan or ethnic origin, religious belief, health status, marital status or sex life, and political opinion or affiliation as sensitive personal data, and apply the measures the Data Protection Authority prescribes by regulation for processing it.
• Obtain consent from a parent or other appropriate legal representative before processing the personal data of a child or of an individual otherwise lacking legal capacity, unless the child is sixteen or older and is asking for an electronic service themselves.
• Apply appropriate processes to verify the identity and age of a data subject and of a representative giving consent for them.

Data Protection Act, Law No. 005 of 2023, arts. 25-27 (data breach notifications) · Read the law's page

• Notify the Data Protection Authority of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals within 72 hours after becoming aware of it.
• Where you extend that deadline for the legitimate needs of law enforcement or to determine the scope of the breach, tell the Authority the grounds for the extension, with supporting evidence, before the original deadline expires.
• Communicate a breach likely to result in a high risk to a data subject to each affected data subject without undue delay, in plain and clear language, or through widely used media where direct communication would take disproportionate effort or expense.
• Set out in every breach notification and communication the nature of the breach, a contact point, the likely consequences, the measures taken to address it, and, for a communication to data subjects, advice on what they can do to mitigate it.
• Keep a record of every personal data breach.

Data Protection Act, Law No. 005 of 2023, arts. 30-31 (cross-border transfers) · Read the law's page

• Before transferring personal data outside Somalia or to an international organisation, confirm the recipient country, organisation or mechanism affords an adequate level of protection, or rely on a ground the Act lists.
• Where you transfer without adequate protection on the data subject's consent, inform them of the risks of the transfer first, and stop if they withdraw consent.

Data Protection Act, Law No. 005 of 2023, arts. 35-40 (complaints, orders and civil remedies) · Read the law's page

• Expect the Data Protection Authority to investigate a complaint that your processing violates the Act, and to be able to order you to stop, to remedy the violation, to compensate the data subject, to account for profits, or to pay an administrative penalty of up to one million United States dollars.
• Comply with an order of the Authority, or apply to the Supreme Court for judicial review within thirty days: failing to comply is an offence carrying the same fine and up to two years' imprisonment.
• Compensate a data subject who suffers injury, loss or harm from your violation of the Act, which they or a consumer organisation acting for them may recover by civil proceedings.