SomaliaData Protection Act, 2023, complaints, orders of the Authority and civil remedies
Data Protection Act, Law No. 005 of 2023, arts. 35-40 (complaints, orders and civil remedies)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://moct.gov.so/en/wp-content/uploads/2023/07/Somalia-Data-Protection-Act-2.pdfIn force.
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Reporting, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Data Protection Authority to investigate a complaint that your processing violates the Act, and to be able to order you to stop, to remedy the violation, to compensate the data subject, to account for profits, or to pay an administrative penalty of up to one million United States dollars.
- Comply with an order of the Authority, or apply to the Supreme Court for judicial review within thirty days: failing to comply is an offence carrying the same fine and up to two years' imprisonment.
- Compensate a data subject who suffers injury, loss or harm from your violation of the Act, which they or a consumer organisation acting for them may recover by civil proceedings.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 38(1) makes it an offence for a data controller to fail to comply with any order made under article 36 that is not the subject of a duly made and ongoing appeal under article 39, liable to a fine of [US one million dollars] or its equivalent in Somali currency and imprisonment for [two] years; the Authority's remedial and penalty orders are made under article 37.
Penalty structure
Administrative penalty the Authority may order against a data controller for a violation of the Act (art. 37(1)(f)); failing to comply with such an order is a separate offence under article 38 carrying the same fine plus up to two years' imprisonment.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
Data Protection Authority
Settledness
- As of
- Open questions
- Does article 38(1) of Law No. 005 of 2023, which makes it an offence to fail to comply with 'any order made under article 36', reach the orders the Authority makes under article 37, given that article 36 gives the Authority only the power to order a person to attend, produce documents or furnish a statement?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 35 to 40 set the complaint, investigation, order, appeal and civil remedy procedure. Article 36(2)(b) lets the Authority, for an investigation, order any person to produce a document, record or article that is relevant and that no other written law bars them from disclosing, and article 36(3) lets it require electronic material in a legible, structured, machine-readable form. That is a power to demand what exists; none of the articles requires anyone to make or keep a log or record, so the duty is none and the expectation on request. The breach record is article 27 and the transfer record article 30(3), both on their own rows.
- Kind
- None
- As of
What this law does
Article 35 lets a data subject aggrieved by an act or omission that violates the Act lodge a complaint with the Authority, which admits a complaint where the complainant has an interest and the complaint is not frivolous or vexatious. Article 36 lets the Authority investigate on a complaint or of its own accord and compel attendance, documents and information.
Article 37 lets the Authority order a data controller to stop the violating processing, remedy the violation, pay compensation to a data subject who suffered injury, loss or harm, account for profits, or pay an administrative penalty of up to one million United States dollars or its equivalent in Somali currency.
Article 38 makes failing to comply with such an order an offence carrying the same fine and imprisonment for two years, and article 39 allows an application to the Supreme Court within thirty days for judicial review of an order. Article 40 lets a data subject who suffers injury, loss or harm, or a consumer organisation acting for them, recover damages by civil proceedings.
The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin. No notice of the Act's publication in the Official Bulletin has been located. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .