SomaliaData Protection Act, 2023, cross-border transfers of personal data
Data Protection Act, Law No. 005 of 2023, arts. 30-31 (cross-border transfers)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdfIn force.
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Before transferring personal data outside Somalia or to an international organisation, confirm the recipient country, organisation or mechanism affords an adequate level of protection, or rely on a ground the Act lists.NIST Privacy FrameworkCT.PO-P2
- Where you transfer without adequate protection on the data subject's consent, inform them of the risks of the transfer first, and stop if they withdraw consent.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 30(3) makes a controller keep a record of the condition it relied on to transfer personal data outside Somalia or to an international organisation, including any adequacy assessment made under article 30(2). Article 30(4)(d) lets the Authority require any controller to notify it of the conditions relied on, which is the Authority's route to what the record holds. The conditions and the assessment are not log content values, so the contents are left empty. The Act sets no period for keeping the record, so no retention value is recorded. Article 31(3) separately makes a controller that transfers under article 31(2) inform the Authority and the data subject; that is a notification and not a record.
- Kind
- Explicit
- As of
- Provision
- Article 30(3)
- Trigger
- personal_data_processing
What this law does
Article 30(1) prohibits a data controller from transferring personal data to a country outside the Federal Republic of Somalia or to an international organisation unless the data will be received only where an adequate level of protection applies, the recipient is an international organisation whose policies and measures afford an adequate level of protection, the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct, certification mechanism or other measure affording an adequate level of protection, or a legal basis in article 31 applies.
Article 30(2) lists the factors adequacy is assessed against. Article 31 permits a transfer without adequate protection where the data subject has given and not withdrawn consent after being informed of the risks, the transfer is necessary for a contract with or in the interest of the data subject, or another listed ground applies. The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin.
No notice of the Act's publication in the Official Bulletin has been located. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .