Somalia

Article 25(1) requires a data controller to notify the Authority of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals within seventy-two hours after having become aware of it.

Article 25(2) and (3) let the controller extend that period for the legitimate needs of law enforcement or as reasonably necessary to determine the scope of the breach, provided it tells the Authority the grounds for the extension, with supporting evidence, inside the same seventy-two hours.

Article 25(4) requires the controller to communicate a breach likely to result in a high risk to a data subject to each affected data subject without undue delay, in plain and clear language, and article 25(5) allows communication through widely used media where direct communication would involve disproportionate effort or expense. Article 26 sets out what a notification and a communication must contain, and article 27 requires a record of breaches.

The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin, and no publication date has been located, so the day it took effect is not stated here. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.

Article 4 applies the Act to a data controller domiciled, resident or operating in the Federal Republic of Somalia, to processing that occurs in Somalia, and to processing that monitors the behaviour of, or targets goods or services to, a data subject in Somalia, and article 5 exempts purely personal, recreational or household processing and specified functions of competent authorities.

Article 14 permits processing only on a listed lawful basis, such as the data subject's consent, the performance of a contract, a legal obligation or the data subject having intentionally made the data public, and requires fair and transparent processing. Article 15 requires purpose specification, data minimisation, limited retention and accuracy, and article 17 puts the burden of proving consent on the data controller.

Article 19 requires a data controller to keep a record of its data processors and to take reasonable measures to ensure they process in a way that keeps the controller compliant.

Article 24 requires appropriate technical and organisational measures to secure personal data, article 29 requires a data controller of major importance to carry out a data protection impact assessment before high-risk processing and to submit the report to the Authority, and articles 32 to 34 require such a controller to register with the Authority within six months of qualifying and to designate a data protection officer.

The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin, and no publication date has been located, so the day it took effect is not stated here. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.

Article 30(1) prohibits a data controller from transferring personal data to a country outside the Federal Republic of Somalia or to an international organisation unless the data will be received only where an adequate level of protection applies, the recipient is an international organisation whose policies and measures afford an adequate level of protection, the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct, certification mechanism or other measure affording an adequate level of protection, or a legal basis in article 31 applies.

Article 30(2) lists the factors adequacy is assessed against. Article 31 permits a transfer without adequate protection where the data subject has given and not withdrawn consent after being informed of the risks, the transfer is necessary for a contract with or in the interest of the data subject, or another listed ground applies.

The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin, and no publication date has been located, so the day it took effect is not stated here. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.

Article 18 requires a data controller to inform a data subject, before it collects their personal data, of the controller's identity and contact details, the basis and purposes of processing, who the data will be shared with, the data subject's rights and right to complain to the Authority, and a description of any automated decision-making, including profiling, and its likely consequences.

Article 20 gives a data subject the right to obtain, at no expense and without unreasonable delay, confirmation of whether their personal data is being processed and its source, a copy in a commonly used electronic format, correction or deletion of inaccurate, out of date, incomplete or misleading data, and deletion of data the controller is not entitled to retain. Article 21 gives the right to withdraw consent and requires withdrawal to be as easy as giving it.

Article 22 gives the right to object to processing that causes substantial unwarranted damage or distress on the grounds it names. Article 23 gives the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similar significant effects, except where the decision is necessary for a contract, authorised by a written law with safeguards, or authorised by the data subject's consent.

The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin, and no publication date has been located, so the day it took effect is not stated here. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.

Article 35 lets a data subject aggrieved by an act or omission that violates the Act lodge a complaint with the Authority, which admits a complaint where the complainant has an interest and the complaint is not frivolous or vexatious. Article 36 lets the Authority investigate on a complaint or of its own accord and compel attendance, documents and information.

Article 37 lets the Authority order a data controller to stop the violating processing, remedy the violation, pay compensation to a data subject who suffered injury, loss or harm, account for profits, or pay an administrative penalty of up to one million United States dollars or its equivalent in Somali currency.

Article 38 makes failing to comply with such an order an offence carrying the same fine and imprisonment for two years, and article 39 allows an application to the Supreme Court within thirty days for judicial review of an order. Article 40 lets a data subject who suffers injury, loss or harm, or a consumer organisation acting for them, recover damages by civil proceedings.

The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin, and no publication date has been located, so the day it took effect is not stated here. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.

Article 2(15) defines sensitive personal data as personal data relating to an individual's biometric data, race, clan or ethnic origin, religious beliefs, health status, marital status or sex life, or political opinions or affiliations, together with any further category the Authority prescribes by regulation.

Article 14(5) empowers the Authority to prescribe in regulations the measures that must be applied to the processing of sensitive personal data, having regard to the risk of significant harm, the expectation of confidentiality and the protection afforded to personal data generally, so the heightened measures themselves are set by regulation rather than by the Act.

Article 16 requires consent for a child or an individual otherwise lacking legal capacity to be obtained from a parent or other appropriate legal representative, permits a data controller to rely on the consent of a child aged sixteen or more for information and services supplied by electronic means at that child's own request, lets the Authority extend that to a child aged thirteen or more by regulation, and requires a controller to verify the identity and age of the data subject and the representative.

The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin, and no publication date has been located, so the day it took effect is not stated here. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.

The Law designates the National Communications Authority as Somalia's highest cybersecurity governance authority. It directs the Authority to identify and designate Critical Information Infrastructure across the telecommunications, financial services, energy, water, transportation and government digital-systems sectors, and requires a designated operator to meet the cybersecurity standards the Authority sets and to comply with the Authority's incident reporting obligations.

It separately requires a cybersecurity company or a cybersecurity professional operating in Somalia to hold a National Communications Authority licence or registration. The Law's designation criteria, its incident reporting clock and threshold, and its penalty provisions were not located in the primary text, so they are not stated here.