EthiopiaPersonal Data Protection Proclamation, personal data breach notification
Proclamation No. 1321/2024, arts. 43-44 (personal data breach notification)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the Authority of a personal data breach within 72 hours of becoming aware of it, giving reasons for any delay.NIST Privacy FrameworkCM.AW-P7
- Communicate a personal data breach to the affected data subject within 72 hours of becoming aware of it, in clear language, describing the likely consequences, the contact point for more information and the measures taken to address it.NIST Privacy FrameworkCM.AW-P7
- As a data processor, notify the data controller without undue delay after becoming aware of a personal data breach.NIST Privacy FrameworkCM.AW-P7
- Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of personal data records concerned, and supply information in phases without undue further delay where it cannot all be given at once.NIST Privacy FrameworkCM.AW-P7
- Document every personal data breach, its facts, its effects and the remedial action taken, so the Authority can assess compliance.NIST Privacy FrameworkPR.PO-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 43(6) requires the controller to document any personal data breach, with its facts, effects and the remedial action taken, so that the Authority can assess compliance. That is a breach register for notified breaches and any others alike. The Authority's assessment is a check on the record whenever it chooses to make one, a power the Authority may exercise whenever it chooses. Articles 43(1) to 43(5) and 44 are duties to notify the Authority and the data subject, which are not records.
- Kind
- Explicit
- As of
- Provision
- Article 43(6) (the controller documents every personal data breach)
- Trigger
- security_incident
What this law does
Article 43(1) requires a data controller, where there is a personal data breach, to notify the breach to the Authority within 72 hours after having become aware of it, and article 43(2) requires a notification made outside that period to be accompanied by reasons for the delay. Article 43(3) requires a data processor to notify the data controller without undue delay after becoming aware of a personal data breach.
Article 43(4) fixes what the notification to the Authority must contain: the nature of the breach including, where possible, the categories and approximate number of data subjects and of personal data records concerned, the name and contact details of the data protection officer or other contact point, the likely consequences, and the measures taken or proposed to address the breach and mitigate its adverse effects, with information supplied in phases without undue further delay where it cannot all be given at once.
Article 43(6) requires the data controller to document every personal data breach, its facts, effects and remedial action, so that the Authority can assess compliance.
Article 44(1) requires the controller to communicate the personal data breach to the data subject within 72 hours after having become aware of it, in clear language and with the article 43(4) information on contact point, consequences and measures, and article 44(3) excuses that communication only where the affected data were protected by measures such as encryption that render them unintelligible, where subsequent measures have made the high risk no longer likely to materialize, or where direct communication would involve disproportionate effort and a public communication of equal effect has been made; article 44(4) lets the Authority require the communication anyway.
Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .