Digital Code, Book I: Personal Data Protection and CNDP

Article 2 states that Book I regulates the collection, transmission, storage, use and any other form of processing of personal data. Article 3 applies the book to automated and manual processing of personal data carried out by the State, a local authority, a public or private legal person, or a natural person, and Article 4 extends it to a controller or processor not established in Djibouti that offers goods or services to, or monitors the behaviour of, persons in Djibouti.

Article 5 exempts only purely domestic or personal processing not intended for onward communication, and temporary technical copies made for network transmission.

Article 6 places responsibility for a processing operation on the controller carrying it out under its own authority, Article 7 governs joint controllers, Article 8 governs recourse to a processor, Article 9 governs a sub-processing chain, and Article 10 requires a controller or processor not established in Djibouti to designate a representative there.

Article 11 requires data protection by design and by default, Article 12 requires processing to be carried out confidentially by persons acting under the controller's authority and on its instructions alone, and Article 13 requires the controller and processor to take the measures necessary to secure personal data, having regard to its nature and the risks the processing presents.

Article 54 sets the lawfulness, fairness, transparency, purpose-limitation and minimisation principles, and Article 57 requires an express, unambiguous, free, specific and informed consent wherever consent is the ground relied on.

Article 66 subjects processing to a prior declaration to the Commission unless another provision of this chapter says otherwise, Article 67 lets the Commission set a simplified declaration for the most common categories of processing, Article 68 exempts processing from declaration where the controller has designated a data protection officer, Article 69 subjects the processing it lists to the Commission's prior authorisation, and Article 73 exempts the processing it lists from every one of these prior formalities.

The Digital Code, including Book I, was adopted by the National Assembly on 30 June 2025 and signed by the President of the Republic on 6 July 2025. It was published in the Journal Officiel on 18 September 2025, the date these provisions took effect.