EthiopiaPersonal Data Protection Proclamation
Proclamation No. 1321/2024 (Federal Negarit Gazette), arts. 1-3, 6-8, 12-17, 33-42 and 45-52
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Security, Retention, Governance, DPIA
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Have a lawful basis for processing personal data before collecting, storing, or otherwise processing it, whether by automated means or in a filing system.NIST Privacy FrameworkCT.PO-P1
- Register with the Ethiopian Communications Authority before processing personal data, and appoint a data protection officer where the Proclamation requires one.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkGV.PO-P3
- Take consent only where it is free, informed, specific and clear and requires an active action from the data subject, request it separately from other terms rather than bundled with them, let the data subject withdraw it at any time, and be able to prove it was given.NIST Privacy FrameworkCT.PO-P1
- Implement appropriate technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or damage, including pseudonymization and encryption, the ability to restore access to personal data after a physical or technical incident, and a process for regularly testing their effectiveness.NIST Privacy FrameworkPR.DS-P5
- Maintain a record, including logs, of all processing operations under your responsibility, covering the purposes, the categories of data subjects, personal data and recipients, any transfers to another country and their safeguards, and make it available to the Authority on request.NIST Privacy FrameworkID.IM-P4
- Carry out a data protection impact assessment before processing that may risk data subjects' rights and freedoms, including systematic and extensive evaluation based on automated processing, large-scale processing of sensitive personal data, and systematic monitoring of a publicly accessible area on a large scale.NIST Privacy FrameworkID.RA-P4
- Obtain the Authority's prior authorization where you cannot provide appropriate safeguards for a transfer to a third-party jurisdiction, and consult the Authority before processing where an impact assessment indicates the operations are likely to present a high risk.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkGV.PO-P5
- Destroy personal data as soon as is reasonably practicable once the purpose for storing it has lapsed, in a manner that prevents its reconstruction in an intelligible form, and tell any data processor holding the data to do the same.NIST Privacy FrameworkCT.DM-P5NIST Privacy FrameworkCM.AW-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Article 7 of Personal Data Protection Proclamation No. 1321/2024, which makes processing lawful where it serves "the legitimate interests pursued by the personal data controller to whom the data is disclosed", let a controller that collects personal data from public web pages rely on legitimate interests where no one has disclosed the data to it?
- Does the duty in Article 22 to ensure storage "on a server or data center located in Ethiopia" of "personal data collected or obtained locally" reach a controller outside Ethiopia that collects data about people in Ethiopia from public web pages?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 46(1) requires every controller and processor to keep, including by logging, a record of all processing operations; Article 46(2) lists what the record sets out (contacts, purposes, categories of data subjects and data, recipients, transfers, erasure time limits, security mechanisms), which are not log fields. Article 46(4) requires logs of processing activities including reading, and says a log of reading, disclosure or transmission shows why the act was done, its date and time, who read, disclosed or transmitted the data and the recipients. Article 8(5) puts the burden of proving consent on the controller and Article 52(2) requires it to be able to demonstrate compliance. Article 46(4)(e) leaves the retention period of logs to the Authority, so the Proclamation states no retention period for logs; Article 15 limits how long personal data is stored and is not a log retention. Article 3(2)(b) also reaches a controller or processor not established in Ethiopia that uses equipment in Ethiopia and has a representative there.
- Kind
- Explicit
- As of
- Provision
- Article 46(1) and (4) (a record of all processing operations, including logs of reading, disclosure and transmission), with Article 46(3) (the record is made available to the Authority on request) and Article 52(2) (the controller must be able to demonstrate compliance)
- Trigger
- personal_data_processing
What this law does
Article 3 applies the Proclamation to processing personal data wholly or partly by automated means, and to other processing where the data form part of a filing system, by a data controller or data processor established in Ethiopia or using equipment in Ethiopia and represented there; it reaches private and public institutions of the federal and regional governments alike, and its exceptions are exhaustive, covering only an individual's purely personal or household activity, need-to-know exchange between government agencies, restricted application, and data merely transiting Ethiopia.
Article 7 bars processing unless one of the listed conditions is met, beginning with the data subject's consent and running through contractual necessity, a legal obligation, vital interests, a public health crisis or national emergency, and legitimate interests that the data subject's fundamental rights do not override.
Article 8 requires consent to be free, informed, specific and clear, to be requested separately from other terms rather than bundled with them, and to be withdrawable at any time, with the burden of proving consent on the data controller.
Articles 12 to 15 carry the fairness, transparency, purpose-limitation, accuracy and storage-limitation principles, and articles 16 and 17 require appropriate technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or damage, including pseudonymization and encryption, the ability to restore access after a physical or technical incident, and regular testing of those measures.
Article 33 makes registration with the Authority a precondition of processing personal data, articles 34 to 39 govern refusal, effects, change, removal and cancellation of that registration, and article 40 requires a data protection officer where processing is carried out by a government body, where core activities require regular and systematic monitoring of data subjects on a large scale, or where core activities involve large-scale processing of sensitive personal data.
Article 46 requires a record, including logs, of all processing operations, article 47 requires a data protection impact assessment before processing that may risk data subjects' rights and freedoms, article 48 requires prior authorization from or consultation with the Authority in the cases it lists, article 49 requires data protection by design and by default, and article 50 requires personal data to be destroyed as soon as is reasonably practicable once the purpose for storing it has lapsed, in a manner that prevents reconstruction.
Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .