SomaliaData Protection Act, 2023, information to the data subject and rights of the data subject
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdfIn force.
A data subject rights rule binding public and private bodies.
- Obligation class
- Disclosure, Data subject rights
- Audit expectation
- none
What it requires
- Before you collect personal data, tell the data subject who you are, the basis and purposes of the processing, who you will share the data with, their rights and their right to complain to the Authority, and describe any automated decision-making and its likely consequences.NIST Privacy FrameworkCM.AW-P1
- On request, confirm whether you process a person's personal data and where it came from, give them a copy in a commonly used electronic format, and correct or delete data that is inaccurate, out of date, incomplete or misleading, at no expense and without unreasonable delay.NIST Privacy FrameworkCT.PO-P3
- Let a data subject withdraw consent as easily as they gave it, and tell them what withdrawing means.NIST Privacy FrameworkCT.PO-P1
- Stop processing personal data a data subject validly objects to, unless a public interest or other legitimate ground outweighs the unwarranted damage or distress.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 18 makes a controller tell the data subject, before collection, who it is, the basis and purposes, who receives the data, the data subject's rights and the right to complain; articles 20 to 22 give the rights of confirmation, access, correction, deletion, withdrawal of consent and objection. Each is a duty to inform or to answer a request. None of them requires the controller to keep, make or produce a log or record. The record of processors (article 19) and the burden of proving consent (article 17) are outside the articles this row cites and sit on the general row.
- Kind
- None
- As of
What this law does
Article 18 requires a data controller to inform a data subject, before it collects their personal data, of the controller's identity and contact details, the basis and purposes of processing, who the data will be shared with, the data subject's rights and right to complain to the Authority, and a description of any automated decision-making, including profiling, and its likely consequences.
Article 20 gives a data subject the right to obtain, at no expense and without unreasonable delay, confirmation of whether their personal data is being processed and its source, a copy in a commonly used electronic format, correction or deletion of inaccurate, out of date, incomplete or misleading data, and deletion of data the controller is not entitled to retain. Article 21 gives the right to withdraw consent and requires withdrawal to be as easy as giving it.
Article 22 gives the right to object to processing that causes substantial unwarranted damage or distress on the grounds it names. The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin. No notice of the Act's publication in the Official Bulletin has been located. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .