SomaliaData Protection Act No. 005 of 2023
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdfIn force.
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Consent, Disclosure, Security, DPIA, Governance, Licensing
- Audit expectation
- none
What it requires
- Establish a lawful basis before processing personal data, such as the data subject's consent, the performance of a contract, a legal obligation, or the data subject having intentionally made the data public, and process it fairly and transparently.NIST Privacy FrameworkCT.PO-P1
- Collect personal data for a specified, explicit and legitimate purpose, keep it to the minimum necessary for that purpose, keep it accurate, and retain it no longer than the purpose requires.NIST Privacy FrameworkGV.PO-P1
- Where you rely on consent, be able to prove the data subject gave it.NIST Privacy FrameworkCT.PO-P1
- Keep a record of every data processor handling personal data you control, and take reasonable measures to ensure each one processes in a way that keeps you compliant.NIST Privacy FrameworkID.IM-P2NIST Privacy FrameworkID.DE-P5
- Implement appropriate technical and organisational measures to secure personal data, taking into account the amount and sensitivity of the data and the harm its loss or misuse would cause.NIST Privacy FrameworkPR.DS-P5
- As a data controller of major importance, carry out a data protection impact assessment before processing likely to result in a high risk to a data subject, and submit the assessment report to the Authority before you start.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.PO-P5
- As a data controller of major importance, register with the Authority within six months of qualifying, and designate a data protection officer.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkGV.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P2Owners or operators (e.g., the organization or third parties such as service providers, partners, customers, and developers) and their roles with respect to the systems/products/services and components (e.g., internal or external) that process data are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- ID.DE-P5Data processing ecosystem parties are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual, interoperability framework, or other obligations.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Article 19(1) requires a controller to keep a record of every data processor that processes personal data for it, including processors engaged by other processors. That is a register of who handles the data rather than a log of events, so the clause names no log content. Article 17(1) puts the burden of proving consent on a controller that relies on it, which cannot be met without a record of the consent; it bears only on a record of consent. The Act sets no period for keeping either record. Article 4 also reaches processing that occurs within Somalia, a prong that turns on where the processing is done. The impact assessment report article 29 requires of a controller of major importance is submitted to the Authority before processing, which is the controller's own filing and not an audit; the Authority's power to order production of documents and records is in article 36(2)(b), outside the articles this row cites, and sits on the complaints row.
- Kind
- Explicit
- As of
- Provision
- Articles 19(1) and 17(1)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Article 4 applies the Act to a data controller domiciled, resident or operating in the Federal Republic of Somalia, to processing that occurs in Somalia, and to processing that monitors the behaviour of, or targets goods or services to, a data subject in Somalia, and article 5 exempts purely personal, recreational or household processing and specified functions of competent authorities.
Article 14 permits processing only on a listed lawful basis, such as the data subject's consent, the performance of a contract, a legal obligation or the data subject having intentionally made the data public, and requires fair and transparent processing. Article 15 requires purpose specification, data minimisation, limited retention and accuracy, and article 17 puts the burden of proving consent on the data controller.
Article 19 requires a data controller to keep a record of its data processors and to take reasonable measures to ensure they process in a way that keeps the controller compliant.
Article 24 requires appropriate technical and organisational measures to secure personal data, article 29 requires a data controller of major importance to carry out a data protection impact assessment before high-risk processing and to submit the report to the Authority, and articles 32 to 34 require such a controller to register with the Authority within six months of qualifying and to designate a data protection officer.
The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin. No notice of the Act's publication in the Official Bulletin has been located. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .