SomaliaData Protection Act, 2023, sensitive personal data and children's consent
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdfIn force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Biometric
- Audit expectation
- none
What it requires
- Treat biometric data, race, clan or ethnic origin, religious belief, health status, marital status or sex life, and political opinion or affiliation as sensitive personal data, and apply the measures the Data Protection Authority prescribes by regulation for processing it.NIST Privacy FrameworkGV.PO-P5
- Obtain consent from a parent or other appropriate legal representative before processing the personal data of a child or of an individual otherwise lacking legal capacity, unless the child is sixteen or older and is asking for an electronic service themselves.NIST Privacy FrameworkCT.PO-P1
- Apply appropriate processes to verify the identity and age of a data subject and of a representative giving consent for them.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 16(4) makes a controller apply appropriate processes to verify the identity and age of a data subject, of the representative and of the relationship, and to verify consent. That is a check made when consent is taken; the clause does not ask the controller to keep or produce a record of it. Article 2(15) defines sensitive personal data and article 14(5) lets the Authority prescribe measures for it by regulation; neither requires a record, and no such regulation is read here. The controller's burden of proving consent is article 17(1), which is outside the articles this row cites and sits on the general row.
- Kind
- None
- As of
What this law does
Article 2(15) defines sensitive personal data as personal data relating to an individual's biometric data, race, clan or ethnic origin, religious beliefs, health status, marital status or sex life, or political opinions or affiliations, together with any further category the Authority prescribes by regulation.
Article 14(5) empowers the Authority to prescribe in regulations the measures that must be applied to the processing of sensitive personal data, having regard to the risk of significant harm, the expectation of confidentiality and the protection afforded to personal data generally, so the heightened measures themselves are set by regulation rather than by the Act.
Article 16 requires consent for a child or an individual otherwise lacking legal capacity to be obtained from a parent or other appropriate legal representative, permits a data controller to rely on the consent of a child aged sixteen or more for information and services supplied by electronic means at that child's own request, lets the Authority extend that to a child aged thirteen or more by regulation, and requires a controller to verify the identity and age of the data subject and the representative.
The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin. No notice of the Act's publication in the Official Bulletin has been located. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .