Djibouti

Article 1's definitions chapter defines child pornography as any visual representation of sexually explicit conduct, including a photograph, film, video, or image, whether manufactured or produced by electronic, mechanical, or other means, where a minor is involved in the production, and expressly includes a digital image, a computer image, or a computer-generated image in which a minor is engaged in sexually explicit conduct, as well as a visual representation created, adapted, or modified so that a minor appears to engage in such conduct.

Article 595 punishes anyone who produces, records, offers, makes available, distributes, or transmits, by means of an information system, an image or representation bearing the character of child pornography, with imprisonment of 2 to 7 years and a fine of 14,000,000 to 70,000,000 Djiboutian francs. Article 596 punishes procuring, importing, or exporting such an image or representation with imprisonment of 6 months to 5 years and a fine of 35,000,000 to 350,000,000 francs.

Article 597 punishes possessing such an image or representation, or facilitating a minor's access to pornographic material, with the same penalties as Article 596. Article 598 punishes habitually consulting an online public communication service that makes such an image or representation available, with 10 years' imprisonment and a fine of up to 17,500,000 francs.

Because the Article 1 definition already reaches a computer-generated image without requiring a real child to have been depicted, these offences bind an AI system's output on the same terms as a photograph or video.

Article 14 requires the controller, in the event of a personal-data breach, to notify the Commission without undue delay and, at the latest, within 72 hours of becoming aware of it, and to accompany a notification made outside that window with the reasons for the delay.

Article 14 also requires the processor to notify the controller of a personal-data breach without undue delay after becoming aware of it, and requires the notification to the Commission to describe the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned, the contact point, the likely consequences, and the measures taken or proposed to address it, supplied in stages without further undue delay where it cannot all be given at once.

Article 14's closing paragraph requires the controller to keep a register of every personal-data breach, its facts, its effects and the remedial measures taken, for the Commission to check compliance on request.

Article 15 requires the controller to tell the affected individual of a breach without undue delay, in clear and simple terms, where the breach is likely to result in a high risk to their rights and freedoms, and excuses that communication only where protective measures such as encryption render the affected data unintelligible, where subsequent measures make the high risk no longer likely, or where it would involve a disproportionate effort and an equally effective public communication is made instead.

The Digital Code, including Book I, was adopted by the National Assembly on 30 June 2025 and signed by the President of the Republic on 6 July 2025. It was published in the Journal Officiel on 18 September 2025, the date these provisions took effect.

Article 2 states that Book I regulates the collection, transmission, storage, use and any other form of processing of personal data. Article 3 applies the book to automated and manual processing of personal data carried out by the State, a local authority, a public or private legal person, or a natural person, and Article 4 extends it to a controller or processor not established in Djibouti that offers goods or services to, or monitors the behaviour of, persons in Djibouti.

Article 5 exempts only purely domestic or personal processing not intended for onward communication, and temporary technical copies made for network transmission.

Article 6 places responsibility for a processing operation on the controller carrying it out under its own authority, Article 7 governs joint controllers, Article 8 governs recourse to a processor, Article 9 governs a sub-processing chain, and Article 10 requires a controller or processor not established in Djibouti to designate a representative there.

Article 11 requires data protection by design and by default, Article 12 requires processing to be carried out confidentially by persons acting under the controller's authority and on its instructions alone, and Article 13 requires the controller and processor to take the measures necessary to secure personal data, having regard to its nature and the risks the processing presents.

Article 54 sets the lawfulness, fairness, transparency, purpose-limitation and minimisation principles, and Article 57 requires an express, unambiguous, free, specific and informed consent wherever consent is the ground relied on.

Article 66 subjects processing to a prior declaration to the Commission unless another provision of this chapter says otherwise, Article 67 lets the Commission set a simplified declaration for the most common categories of processing, Article 68 exempts processing from declaration where the controller has designated a data protection officer, Article 69 subjects the processing it lists to the Commission's prior authorisation, and Article 73 exempts the processing it lists from every one of these prior formalities.

The Digital Code, including Book I, was adopted by the National Assembly on 30 June 2025 and signed by the President of the Republic on 6 July 2025. It was published in the Journal Officiel on 18 September 2025, the date these provisions took effect.

Article 99 bars a controller or processor from transferring personal data to a country or international organisation outside Djibouti unless that country or organisation ensures a level of protection equivalent and sufficient to Book I's own, and applies the same requirement to an onward transfer from the destination country or organisation to a further one.

Article 100 sets the factors the Commission weighs to determine whether that level of protection is equivalent and sufficient, including the rule of law, the respect for fundamental freedoms and rights, and the legislation, general and sectoral, in force in the destination country or organisation.

Article 101 lets the Commission withdraw a country or organisation from its adequacy list, refuse a declared transfer, or order an existing transfer to that destination to stop, once it finds the destination no longer ensures a sufficient level of protection.

Article 102 lets a controller or processor transfer personal data to a non-adequate third country outside the African Union, or to a non-adequate international organisation, only on the conditions it lists, including the data subject's express consent to the specific transfer, contractual necessity between the controller and the data subject or a third party, and a legally compelling public-interest ground.

The Digital Code, including Book I, was adopted by the National Assembly on 30 June 2025 and signed by the President of the Republic on 6 July 2025. It was published in the Journal Officiel on 18 September 2025, the date these provisions took effect.

Article 65 bars a decision producing legal effects on a person, or significantly affecting them, from resting solely on automated processing of their personal data, including profiling, unless the decision is authorised by law with appropriate safeguards, or rests on explicit consent or contract performance together with the right to human intervention, to express a point of view, and to contest the decision.

The controller must also disclose, on request, the logic underlying the automated decision and the significance and expected consequences of that processing for the data subject. The Digital Code, including Book I, was adopted by the National Assembly on 30 June 2025 and signed by the President of the Republic on 6 July 2025. It was published in the Journal Officiel on 18 September 2025, the date these provisions took effect.

Article 104 establishes the Commission Nationale de Protection des Données à Caractère Personnel as an independent administrative authority charged with overseeing compliance with Book I. Article 135 lets the Commission, where a controller does not comply with a formal notice, impose an injunction to bring processing into conformity or to satisfy a data subject's rights request, an injunction to stop processing or a withdrawal of authorisation, the locking of certain data, and an administrative sanction proportioned to the seriousness of the breach and the advantages drawn from it, capped at 70,000,000 Djiboutian francs or, for an enterprise, 5% of its worldwide turnover excluding tax for the last closed financial year, whichever is higher, on top of a daily penalty payment of up to 35,000,000 francs for continued non-compliance.

Chapter 6 (Articles 140 to 156) applies the Penal Code's general rules on attempt, complicity, receiving, and corporate liability to the offences it creates.

Article 141 punishes processing personal data without the prior formalities Chapter 2 of Title 3 requires, and Article 144 punishes processing that includes the national identification number outside an authorised case, each by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 Djiboutian francs, except Article 144's offence, which draws 5 years and a fixed fine of 4,000,000 francs.

Article 145 punishes unlawfully keeping sensitive personal data or offence-related data in computerised memory without the data subject's express consent, Article 146 punishes an unlawful health-research processing, Article 147 punishes fraudulent collection, Article 148 punishes misuse of purpose, and Article 149 punishes an unauthorised cross-border transfer, each by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 Djiboutian francs (Article 149's fine is a fixed 8,000,000 francs).

Article 150 punishes disregarding a data subject's objection by 6 months to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 francs, Article 151 punishes processing without the security measures Articles 11 to 13 require by 10 years' imprisonment and a fixed fine of 8,000,000 francs, Article 152 punishes failing to notify a personal-data breach by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 francs, and Article 153 punishes retaining personal data beyond its legal retention period by the same range.

Article 154 punishes an unauthorised disclosure of personal data by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 francs, falling to a fixed 5 years and 7,000,000 francs where the disclosure was merely negligent, and that prosecution runs only on the victim's own complaint.

Article 155 lets the criminal court order the erasure of the personal data at issue in an offence under this chapter, and Article 156 requires the public prosecutor to keep the Commission's president informed of the prosecutions this chapter's offences give rise to. The Digital Code, including Book I, was adopted by the National Assembly on 30 June 2025 and signed by the President of the Republic on 6 July 2025. It was published in the Journal Officiel on 18 September 2025, the date these provisions took effect.

Article 59 lets a minor consent alone to an information-society service's processing of their personal data only from age 16, requires the consent of the person holding parental authority below that age, and requires the controller to make reasonable efforts to verify that consent given the technology available.

Article 62 prohibits processing personal data revealing, directly or indirectly, racial or ethnic origin, political or philosophical opinions, religious opinions or beliefs, or trade-union membership, and prohibits processing genetic data, biometric data processed to uniquely identify a natural person, or data concerning health, subject to exceptions including the data subject's express and explicit consent to one or more specific purposes, data the data subject has manifestly made public, and vital-interest or public-health grounds.

The Code's own definition of biometric data names facial images, fingerprint data, voiceprints, DNA and iris data as qualifying examples of a characteristic that allows or confirms unique identification, so a voiceprint or a faceprint derived from an ordinary recording is not carved out of the Article 62 prohibition. The Digital Code, including Book I, was adopted by the National Assembly on 30 June 2025 and signed by the President of the Republic on 6 July 2025. It was published in the Journal Officiel on 18 September 2025, the date these provisions took effect.

Article 555 punishes anyone who has accessed or attempted to fraudulently access all or part of an information system with a maximum of three years' imprisonment and a maximum fine of 10,000,000 Djiboutian francs, or either penalty alone. Article 556 punishes fraudulently remaining, or attempting to remain, within all or part of a system after having entered it fraudulently, with the same maximum penalties.

Article 557 raises both offences to a maximum of five years' imprisonment and a maximum fine of 25,000,000 francs where the fraudulent access or continued presence results in the deletion or modification of data held in the system. Article 558 separately punishes fraudulently introducing, or attempting to introduce, data into an information system, with a maximum of five years' imprisonment and a maximum fine of 25,000,000 francs or either penalty alone.

Article 559 punishes disrupting, altering or falsifying, or attempting to disrupt, alter or falsify, the operation of an information system on the same terms as Article 558. Each offence is drafted around unauthorised access or interference with a system rather than around the reading of a page that requires no authorisation, so a scraper confined to public, unauthenticated pages is not on the face of these articles caught by them.

Article 169 requires an operator of a public electronic communications network or a provider of a public electronic communications service to take all appropriate measures to ensure the integrity of its networks and the continuity of the services it supplies, and to take all technical and organisational measures necessary to secure its network and services at a level adapted to the existing risk.

The operator must comply with the technical security prescriptions the national cybersecurity authority issues, must give that authority confidential access to its network-security arrangements on request, and must submit to a security and integrity inspection the authority conducts or commissions, at the operator's expense.

Where there is a particular risk of a breach of its network's security, the operator must inform users of the risk without delay, together with any available remedy and its cost.

As soon as it becomes aware of a security breach or integrity loss with a significant impact on the operation of its networks or services, the operator must notify both the cybersecurity authority and the telecoms regulator by registered letter with acknowledgement of receipt, and must separately notify the cybersecurity authority where the breach results or may result from a cyberattack; the article states no numeric reporting clock for this notice, only that it follows as soon as the operator has knowledge of the breach.

Book VI's Titre 3, headed the implementation of non-military and non-economic defence, requires an operator (the Code's own definition: any natural or legal person operating a public electronic communications network or providing a public electronic communications service to the public) to implement a qualified system for detecting events capable of affecting its information systems' security, qualified by the national cybersecurity authority together with the service providers that run such systems (Article 679).

The operator must submit its information systems to controls the cybersecurity authority conducts to verify their security level and compliance with security rules, at the operator's own cost (Article 680); omitting to maintain and keep in good condition a protective device previously established under this Chapter draws a fine of up to 10,000,000 Djiboutian francs (Article 681).

A separate Chapter lets a State service the Council of Ministers designates by decree hold equipment, instruments, programs and data capable of carrying out an offence, in order to analyse and respond to a cyberattack, a power on the State rather than a duty on the operator (Article 682), and lets a competent authority the Council of Ministers designates by decree obtain from an electronic communications operator the identity, postal address and electronic address of a user or holder of a vulnerable, threatened or attacked information system, in order to alert them to the vulnerability or compromise (Article 683).

Obstructing the accomplishment of the missions in Articles 682 and 683 draws a fine of up to 25,000,000 Djiboutian francs (Article 684).

Article 760 requires a host of digital health data to hold a conformity certificate the national cybersecurity authority issues before providing that hosting.

Article 761 names the activities that count as certifiable hosting: making available and operationally maintaining the physical site or the physical or virtual infrastructure hosting a health-data information system, making available and maintaining an application-hosting platform for it, administering and operating an information system containing health data, and backing up health data, a list a decree may extend.

Article 762 leaves the certificate's own issuance conditions to a decree proposed by the ministry in charge of the digital economy. Article 763 lets the cybersecurity authority withdraw the certificate for a breach of the legislative or regulatory provisions governing digital health-data hosting, or of the certificate's own conditions, under conditions a decree sets; that decree was not located in this review, and no separate monetary penalty for hosting without certification was located either.

Article 747 requires any person accessing data in Djibouti's national health data system, a category that reaches citizens, health-system users, health professionals, health establishments and their representative organisations, health-insurance financing bodies, State services and public health institutions under the surrounding Chapter, to report a serious information-system security incident to the cybersecurity authority without delay.

An incident the national authority in charge of information systems judges significant is separately and immediately transmitted to the State's competent authorities. A decree, proposed by the minister in charge of the digital economy after the cybersecurity authority's opinion, is to define which categories of security incident count as significant and how they are handled; that decree was not located in this review. The article states no numeric reporting clock, only that notice is given without delay.

Article 8(b) provides that protection shall not apply to news of the day or to miscellaneous facts having the character of mere items of press information, published, broadcast, or communicated to the public, placing bare news reporting entirely outside the Law's subject matter.

Article 54 permits, without the author's consent, several uses of a protected work that has been lawfully published; alínea (b) covers the inclusion of non-substantial quotations from another work, including quotations from newspaper articles and periodicals in the form of press summaries, provided the quotations are compatible with fair practice, their extent does not exceed what the purpose justifies, and the source and the author's name are named in the citing work.

Article 4 extends protection to the authors of anthologies or collections of works, expressions of folklore, or data such as databases that, by reason of the selection or arrangement of their contents, constitute intellectual creations, without creating a separate sui generis database right.

Title 2 (Articles 60 and following) confines neighbouring rights to performers and phonogram producers, and a later Title extends comparable protection to broadcasting organisations, so the Law creates no publisher-side right of the kind the European Union's Digital Single Market Directive Article 15 creates.

Article 116 reserves traditional knowledge, genetic resources, folklore, and the Internet for a future decree to supplement the Law, acknowledging that the Law as enacted does not itself address online use. Article 117 repealed the prior copyright statute, Law No. 114/AN/96 of September 3, 1996.

Article 118 provides that the Law is implemented as a State Law and published in the Official Gazette upon its enactment; WIPO Lex records both promulgation and entry into force on July 23, 2006, the date of enactment itself.