SomaliaData Protection Act, 2023, personal data breach notification
Data Protection Act, Law No. 005 of 2023, arts. 25-27 (data breach notifications)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdfIn force.
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify the Data Protection Authority of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals within 72 hours after becoming aware of it.NIST Privacy FrameworkCM.AW-P7
- Where you extend that deadline for the legitimate needs of law enforcement or to determine the scope of the breach, tell the Authority the grounds for the extension, with supporting evidence, before the original deadline expires.NIST Privacy FrameworkCM.AW-P7
- Communicate a breach likely to result in a high risk to a data subject to each affected data subject without undue delay, in plain and clear language, or through widely used media where direct communication would take disproportionate effort or expense.NIST Privacy FrameworkCM.AW-P7
- Set out in every breach notification and communication the nature of the breach, a contact point, the likely consequences, the measures taken to address it, and, for a communication to data subjects, advice on what they can do to mitigate it.NIST Privacy FrameworkCM.AW-P7
- Keep a record of every personal data breach.NIST Privacy FrameworkPR.PO-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 27(1) makes each controller keep a record of all personal data breaches, with the facts, the effects and the remedial action taken, in a manner that lets the Authority verify compliance with the breach chapter. The record is kept for every breach, whether or not it is notified. The facts, effects and remedial action are not log content values, so the contents are left empty. The Act sets no period for keeping the record, so no retention value is recorded. Article 25 requires notice to the Authority within seventy-two hours (and a statement of the grounds for any extension, article 25(3)) and article 26 sets the contents of a notice; a duty to notify is not itself a record.
- Kind
- Explicit
- As of
- Provision
- Article 27(1)
- Trigger
- security_incident
What this law does
Article 25(1) requires a data controller to notify the Authority of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals within seventy-two hours after having become aware of it.
Article 25(2) and (3) let the controller extend that period for the legitimate needs of law enforcement or as reasonably necessary to determine the scope of the breach, provided it tells the Authority the grounds for the extension, with supporting evidence, inside the same seventy-two hours.
Article 25(4) requires the controller to communicate a breach likely to result in a high risk to a data subject to each affected data subject without undue delay, in plain and clear language, and article 25(5) allows communication through widely used media where direct communication would involve disproportionate effort or expense. Article 26 sets out what a notification and a communication must contain, and article 27 requires a record of breaches.
The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin. No notice of the Act's publication in the Official Bulletin has been located. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .