EthiopiaPersonal Data Protection Proclamation, rights of data subjects
Proclamation No. 1321/2024, arts. 24-30, 32 (rights of data subjects)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Tell a data subject, when you obtain their personal data, who you are, the purposes and lawful basis of the processing, the recipients, any transfer to a third-party jurisdiction, the retention periods, their rights, and whether automated decision-making including profiling is in use; where the data came from elsewhere, add the categories obtained and their source, and give the information within a reasonable period and at the latest one month after obtaining it.NIST Privacy FrameworkCM.AW-P1
- Answer a request for access at reasonable intervals, free of charge and without excessive delay, with confirmation of processing, the data in an intelligible form, their origin and the storage period, in electronic or hard copy at the data subject's preference, and put any refusal in writing with detailed reasons.NIST Privacy FrameworkCT.DM-P1
- Correct inaccurate, incomplete, misleading or out-of-date personal data on request, free of charge and without excessive delay, and pass the correction on to every other data controller or third party the data were disclosed to in the year before the request.NIST Privacy FrameworkCT.DM-P3NIST Privacy FrameworkCM.AW-P5
- Erase personal data on request, free of charge and without excessive delay, where it is no longer necessary for its purpose, where consent is withdrawn and no other ground applies, where the data subject objects and no overriding legitimate ground exists, or where it was processed unlawfully, and take reasonable steps to tell third parties processing data you made public.NIST Privacy FrameworkCT.DM-P4NIST Privacy FrameworkCM.AW-P5
- Stop processing personal data for direct marketing, including the profiling related to it, as soon as the data subject objects, and bring the right to object to the data subject's attention explicitly.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
- Restrict processing on request in the cases article 30 lists, keep the data stored but otherwise unused without the data subject's consent, and tell the data subject before lifting the restriction.NIST Privacy FrameworkCT.PO-P3
- Give a data subject their personal data in a structured, commonly used and machine-readable format on request, free of charge and without excessive delay, and transmit it directly to another controller or processor where that is technically possible.NIST Privacy FrameworkCT.DM-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CT.DM-P2Data elements can be accessed for transmission or disclosure.
- CT.DM-P3Data elements can be accessed for alteration.
- CT.DM-P4Data elements can be accessed for deletion.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
1 more
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 24 to 30 and 32 give the rights to be informed, of access, rectification, erasure, objection, restriction and portability. Article 26 requires a refusal of access to be given in writing with reasons, which is a notice to the data subject and not a record kept. No article here names a log or register or gives the Authority a power over one; the controller's records are in Article 46, which this row does not cite.
- Kind
- None
- As of
What this law does
Article 24 gives a data subject the right to be told the controller's and any representative's name and contact details, the data protection officer's contact details, the purposes and lawful basis of the processing, the recipients, any transfer to a third-party jurisdiction, the retention periods, the rights available including withdrawal of consent and complaint to the Authority, the existence of automated decision-making including profiling, and the categories of personal data processed; where the data were not obtained from the data subject the categories obtained and their source are added, and the information is due when the data are obtained, or otherwise within a reasonable period and at the latest within one month, or by the first communication or first disclosure if either comes sooner.
Article 25 gives a right of access, at reasonable intervals, free of charge and without excessive delay, to confirmation of processing, the data in an intelligible form, their origin, the storage period and the article 24 transparency information, in electronic or hard copy at the data subject's preference, and article 26 lists the narrow grounds on which access may be refused, each refusal to be given in writing with detailed reasons.
Article 27 gives a right to rectification and requires the controller to pass a correction on to anyone the data were disclosed to in the year before the request, article 28 gives a right to erasure on the listed grounds, article 29 gives a right to object, including an unqualified stop to direct marketing and the profiling related to it, article 30 gives a right to restriction of processing, and article 32 gives a right to data portability in a structured, commonly used and machine-readable format, free of charge and without excessive delay.
Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .