SomaliaData Protection Act, 2023, automated decisions
Data Protection Act, Law No. 005 of 2023, art. 23 (automated individual decisions)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdfIn force.
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Do not base a decision that produces legal or similar significant effects on a person solely on automated processing, including profiling, unless a contract, a written law with safeguards, or the person's consent authorises it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 23(1) gives a data subject the right not to be subject to a decision based solely on automated processing, with three exceptions (contract, authorising written law with safeguards, consent). It sets no duty to log the decisions, to keep the grounds of a decision or to produce them to anyone. The information about automated decision-making a controller gives before collection is article 18(1)(e), which sits on the information row.
- Kind
- None
- As of
What this law does
Article 23 gives a data subject the right not to be subject to a decision based solely on automated processing of their personal data, including profiling, that produces legal or similarly significant effects on them.
That right does not apply where the decision is necessary to enter into or perform a contract with the data subject, is authorised by a written law that establishes suitable measures to safeguard the data subject's fundamental rights and interests, or is authorised by the data subject's consent. No notice of the Act's publication in the Official Bulletin has been located.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .