1. Legal and Institutional Framework

1. What are the key legislative and regulatory instruments that govern the protection of personal data in Ethiopia?

The Personal Data Protection Proclamation 1321/2024 (the “Proclamation”) is the primary legislation in terms of governing personal data. There are other legislations containing regulatory provisions governing data privacy. Telecommunications Consumer Rights and Protection Directive No. 832/2021, Computer Crimes Proclamation 958/2016 are other legislations containing provisions applicable for data protection and privacy. The FDRE Constitution also guarantees the right to privacy.

1. What sector-specific frameworks are there that impose additional data protection obligations in industries?

There are sector-specific frameworks imposing additional data protection obligations in Ethiopia. These include:

• Telecommunications (Telecom Fraud Proclamation No. 761/2012, Telecom Consumer Directive No. 832-2021) which protect subscriber data from unlawful access and mandate licensees to ensure consumer privacy;
• ICT (Computer Crimes Proclamation No. 958/2016) which safeguards all forms of data on computer systems from unauthorized access and mandates deletion of irrelevant data from searches;
• Media and Information (Mass Media Proclamation No. 590/2008) which provides a comprehensive definition of personal information and limits disclosure;
• Finance (Financial Consumer Protection Directive No. FCP/01/2020 and National Bank Circular No. FIS/01/2014) which require financial institutions to ensure confidentiality, limit third-party access, and maintain secure infrastructure;
• Health (Regulation No. 299/2013) which restricts disclosure of patient information except for anonymized research;
• Tax (Federal Tax Administration Proclamation No. 983/2016) which protects taxpayer information obtained by tax officials; and
• Digital Communication (Electronic Signature Proclamation No. 1072/2018) which imposes confidentiality obligations on certificate providers.
• Digital ID (Digital Identification Proclamation No. 1284/2024) – Establishes a comprehensive framework for the management of personal data within the national digital identification system. It recognizes registrants’ ownership of their biometric and demographic data, mandates consent-based data processing, and enforces strict confidentiality and data minimization requirements.

1.3 Do any regional or international treaties or cooperative frameworks on data protection apply in Ethiopia?

​As of April 2025, Ethiopia is not a party to any regional or international treaties on data protection. The African Union Convention on Cyber Security and Personal Data Protection, commonly known as the Malabo Convention, entered into force on June 8, 2023, after receiving the required 15 ratifications. However, Ethiopia has neither signed nor ratified this convention.

1. Which public authorities are responsible for the enforcement of data protection laws in Ethiopia? What are their main powers and mandates?

The Ethiopian Communications Authority established under the Communications Service Proclamation No. 1148/2019 serves as the national data protection authority. It operates under the oversight of the Ministry of Innovation and Technology.  The Authority has extensive powers and functions. 

The Authority is vested with broad regulatory, administrative, and oversight powers. It is mandated to ensure the enforcement of the Proclamation, issue enforcement notices to data controllers or processors in cases of non-compliance, impose administrative fines, and obtain injunction orders to prevent the loss or unauthorized modification of personal data.

In terms of oversight, the Authority monitors compliance with data protection principles, oversees the use of personal and sensitive data, and determines whether third-party jurisdictions offer an adequate level of protection equivalent to that of the Proclamation. Additionally, it must submit annual implementation reports to the House of People’s Representatives, thereby ensuring transparency and accountability in the execution of its mandate.

• Scope of Applicability

• Which organizations or persons fall within the scope of the data protection regime in Ethiopia?

The data privacy regime in Ethiopia, applies to:

• Data controllers or data processors established in Ethiopia, provided that personal data are processed in the context of that establishment.
• Data controllers or data processors not established in Ethiopia but using equipment in Ethiopia for processing personal data, except when the data merely transits through Ethiopia.
• Additionally, the Proclamation applies to private and public institutions at both the federal and regional levels, including the City Administrations of Addis Ababa and Dire Dawa, that have the power and function to process personal data.

2.2 Are there any exemptions or exclusions from data protection obligations under Ethiopian law?

Yes, the following data processing activities are exempt from the scope of the law:

1. Processing of personal data by an individual in the course of a purely personal or household activity;
2. Exchange of information between Government Agencies where such an exchange is required on a need-to-know basis;
3. Situations where the application of the Proclamation is restricted;
4. Processing of personal data originating from a foreign country that is merely transiting through Ethiopia to a third country.

Further, the Proclamation provides certain exemptions where data processing activities are deemed necessary and proportionate in a democratic society. These are:

• National security, defense, or public security
• Historical, statistical, and scientific research
• General public interest, including economic or financial interests of the State
• Protection of judicial independence and judicial proceedings
• Protection of a data subject or the rights and freedoms of others

• DOES ETHIOPIA’S DATA PROTECTION FRAMEWORK HAVE EXTRA-TERRITORIAL APPLICATION?

Yes, Ethiopia’s data protection framework exhibits extra-territorial reach under specified conditions. Pursuant to Article 3(2)(b), the Proclamation applies to data controllers or processors not established in Ethiopia but who utilize equipment located within the country for the processing of personal data except where such use is solely for the purpose of data transit. Accordingly, foreign entities that process personal data using infrastructure situated in Ethiopia, or that maintain a representative within the jurisdiction, may be subject to the substantive provisions of the Proclamation.

• KEY CONCEPTS AND DEFINITIONS

3.1 WHAT ARE THE KEY TERMS UNDER THE PERSONAL DATA FRAMEWORK?

1. Personal Data is defined as any information relating to an identified or identifiable natural person who can be identified , directly or indirectly , in particular by reference to an identifier such as a name, an identification number, location data , an online identifier or to one or more factors specific to the physical, physiological , genetic , mental , economic , cultural or social identity of that natural person;
   1. Sensitive Personal Data is defined to include specific categories of personal information that are considered inherently private and capable of causing significant harm or discrimination if misused. This includes data relating to an individual’s racial or ethnic origin, genetic or biometric characteristics, physical or mental health conditions, and political opinions. It also encompasses information on religious beliefs or similar convictions, membership in professional associations, records of criminal offences or alleged offences, judicial proceedings and outcomes, as well as communications data—both content and metadata. Additionally, the Ethiopian Communications Authority is empowered to designate other types of personal data as sensitive, thereby allowing the definition to evolve in line with emerging risks and technologies.
   1. Data Processing refers to any operation, or series of operations, performed on personal data or sets of personal data, whether or not through automated means. This includes a wide range of actions such as collection, recording, organization, structuring, and storage of data, as well as its adaptation, alteration, retrieval, consultation, and use. Processing also encompasses the disclosure of data through transmission, dissemination, or any other form of making it available. Further, it covers the alignment or combination of data, along with actions like restriction, erasure, or destruction of personal data.
   1. Data Subject refers to an individual who is the subject of personal data. This is the person to whom the personal data pertains, essentially the individual whose information is being processed, collected, or stored.
   1. Data Controller is defined as any person or entity, either individually or in collaboration with others, that processes personal data and determines the purposes and methods of such processing.
   1. Data Processor refers to any person or entity, other than an employee of the data controller, who processes personal data on behalf of the data controller. The Data Processor acts under the instructions of the Data Controller and is responsible for carrying out data processing tasks without determining the purpose or means of processing.
   1. Consent is defined as any freely given, specific, informed, and unambiguous indication of the wishes of a data subject regarding the processing of their personal data. This consent can be expressed through various means, including a written statement, verbal affirmations, or any clear affirmative action by which the data subject signifies their agreement to the processing of their personal data.

4. REGISTRATION AND NOTIFICATION REQUIREMENTS

4.1 ARE DATA CONTROLLERS AND/OR PROCESSORS REQUIRED TO REGISTER WITH A REGULATORY BODY IN ETHIOPIA? WHAT ARE THE IMPLICATIONS OF NON-COMPLIANCE?

​Yes, both data controllers and data processors are required to register with the Ethiopian Communications Authority (ECA) before processing personal data.

4.2 WHAT IS THE PROCEDURE FOR REGISTRATION, IF REQUIRED?

The ECA is expected to issue a directive to determine the specific requirements for registration. If a data controller or data processor intends to process personal data for two or more purposes, the ECA will make separate entries in the register for each purpose. If the particulars provided in the application for registration are insufficient, the ECA may reject the application. The ECA must inform the applicant in writing within fourteen days of the decision and provide reasons for the refusal. The rejection does not prevent the applicant from reapplying.

4.3 IS THE INFORMATION PROVIDED IN THE COURSE OF REGISTRATION MADE PUBLICLY ACCESSIBLE?

Yes, the information provided during the registration process is made publicly accessible. The ECA is required to provide facilities for making the information in the register available for inspection by the public during reasonable hours. Additionally, the ECA may supply certified copies of the information contained in the register to any member of the public who requests it.

5. PROCESSING OF PERSONAL DATA

5.1 WHAT LEGAL GROUNDS JUSTIFY THE COLLECTION AND PROCESSING OF PERSONAL DATA IN ETHIOPIA? ARE THERE DIFFERENCES BASED ON THE NATURE OF THE DATA?

Yes, there is a difference based on the nature of the data. While general personal data can be processed under the grounds of consent, contractual necessity, and legal obligations, sensitive personal data (e.g., health data, ethnic origin) is prohibited in principle. Exceptional permission requires stricter conditions and safeguards and can only be processed under more limited circumstances.

5.2 What Key Principles Must be Observed when Processing Personal Data?

At its core, the Ethiopian regime mandates that personal data be processed lawfully, fairly, and transparently, with an emphasis on purpose limitation, data minimization, accuracy, and security. The law underscores the following key principles:

1. Lawfulness, Fairness, Transparency: Data must be processed in accordance with clear legal bases, including consent, contractual necessity, legal obligation, protection of vital interests, public interest, or legitimate interests provided such interests do not override fundamental rights of the data subject. Transparency entails proactive disclosure of processing purposes in clear, plain language and prohibits misleading or unexpected practices.
2. PURPOSE LIMITATION: Data may only be collected for explicit, specific, and lawful purposes and must not be processed further in a manner incompatible with those purposes. Any secondary use e.g., for research or archiving must adhere to statutory safeguards.
3. DATA MINIMIZATION: The processing must be adequate, relevant, and not excessive in relation to the purposes for which it is undertaken.
4. ACCURACY: Controllers are required to maintain accurate and up-to-date records, and must take reasonable steps to rectify inaccuracies without undue delay.
5. STORAGE LIMITATION: Data should be retained only for as long as necessary to fulfill the stated purpose, after which it must be securely erased or anonymized.
6. INTEGRITY AND CONFIDENTIALITY: Appropriate technical and organizational safeguards are mandated to ensure the confidentiality, security, and integrity of data, with particular care required in processing sensitive categories.
7. DATA SOVEREIGNTY: A distinctive feature of Ethiopia’s framework is the requirement that processing also respect the sovereignty of the data, indicating a broader policy focus on national control over data flows potentially influencing cross-border data transfer considerations.
8. CONSENT REQUIREMENTS: Where processing is based on consent, it must be freely given, informed, specific, and unbundled from other terms. Controllers bear the burden of proof and must provide clear opt-out mechanisms. Importantly, consent cannot be made a condition for goods or services unless strictly necessary.
9. PROCESSING OF SENSITIVE DATA AND MINORS: Sensitive personal data such as health, race, or religious affiliation are subject to heightened restrictions, and may only be processed under narrowly defined exceptions, with additional security safeguards. Data concerning minors receives particular protection, including an outright prohibition on its use for profiling or marketing.

5.3 Are there additional rules, restrictions, or best practices that must be observed when handling personal data?

Yes, there are specific rules, restrictions, and best practices that must be observed to ensure the integrity and confidentiality of personal data. These include:

1. Implementation of Appropriate Measures: Data controllers and processors must implement technical and organizational safeguards to prevent unauthorized or unlawful processing, and to protect against accidental loss, destruction, or damage of personal data.
2. Risk-Based Security: The level of security must be commensurate with:
   1. The potential harm resulting from unauthorized access or loss; and
   1. The nature of the data being processed.
3. Adaptive Security Measures: Security measures should evolve in line with technological developments and reflect the nature, scope, context, and purpose of processing, as well as the likelihood and severity of risks to individuals.
4. Best Practices Include:
   1. Pseudonymization and encryption of data.
   1. Ensuring confidentiality, integrity, availability, and resilience of systems.
   1. Procedures for timely restoration of data in case of incidents.
   1. Regular testing and evaluation of security measures.

6. Data Sharing and Transfers

6.1 What requirements govern the sharing of personal data with third parties?

Sharing personal data with third parties particularly across borders is permitted only if the recipient jurisdiction ensures an “appropriate level of protection.” This adequacy is assessed contextually, considering factors such as the nature and purpose of data processing, legal regime of the recipient country, and applicable professional and security standards. In exceptional cases, where adequate protection is lacking, the Data Protection Authority may still authorize limited transfers provided that the rights of data subjects are preserved, explicit consent is obtained, and data is minimized or pseudonymized appropriately.

6.2 What rules apply to the transfer of personal data outside Ethiopia? Are certain destinations subject to stricter requirements?

Cross-border transfers are strictly regulated and may proceed only if one of the following conditions is met: (i) the recipient jurisdiction has been found by the Authority to offer adequate protection; (ii) the data subject gives explicit, informed consent; (iii) the transfer is legally necessary (e.g., contractual performance, legal claims, public interest); or (iv) the data is drawn from a publicly accessible register. Transfers to jurisdictions lacking adequate protection are outright prohibited unless expressly authorized by the Authority under narrowly defined circumstances. Sensitive personal data is subject to a heightened regime, requiring prior approval from the Authority in all cases.

6.3 What compliance measures or safeguards are recommended for both domestic and cross-border data transfers?

Data controllers and processors must implement robust security measures to ensure the effectiveness of safeguards before any cross-border transfer. They should be prepared to demonstrate these measures upon request by the Authority. Additionally, all personal data collected within Ethiopia must be stored on servers or data centers located in-country, and categories of data designated as "critical" or "sensitive" by the Authority are subject to heightened data localization and prior approval requirements. The Authority retains discretion to prohibit or impose conditions on any transfer to protect the fundamental rights of data subjects.

7. Rights of Individuals (Data Subjects)

7.1 What rights do individuals have over their personal data under Ethiopian law? Are there any limitations?

Under the Personal Data Protection Proclamation No. 1262/2023, data subjects have the right to: (i) be informed of data processing; (ii) access their personal data; (iii) rectify or update inaccurate data; (iv) object to processing on legitimate grounds; (v) request erasure where processing is unlawful or no longer necessary; and (vi) lodge complaints with the supervisory authority. These rights are subject to certain limitations, including national security, public interest, performance of a legal obligation, or legitimate interest of the controller that overrides the data subject’s rights.

7.2 What legal or administrative remedies are available to individuals whose data rights have been violated?

Individuals may file complaints with the ECA, which has investigative and enforcement powers including issuing orders, imposing fines, or requiring rectification. Furthermore, intentional or negligent violations may attract criminal liability. Specifically, failure to notify a data breach, implement protective measures, or process data lawfully may lead to imprisonment from one to three years or a fine of 60,000 to 100,000 Birr, or both. Further violations of data subject rights such as failing to erase data, ignoring objections to processing, or allowing automated decisions may result in imprisonment from three to five years or a fine of 100,000 to 200,000 Birr, or both. More severe offenses, including re-identifying de-identified data, processing re-identified data, selling or transferring data unlawfully, or transferring data outside Ethiopia, can result in imprisonment for five to ten years, fines of 200,000 to 600,000 Birr, or both. In cases where the offense is committed by an institution, involves sensitive data or minors, or causes significant harm, a fine of up to 4% of the institution’s total annual turnover for the preceding financial year may be imposed.

8. Compliance and Governance

8.1 Is there a legal obligation to appoint a data protection officer in Ethiopia? What are the consequences for failing to do so?

Yes. Appointing a Data Protection Officer (DPO) is mandatory where (i) the data controller or processor is a government body (excluding courts), (ii) core activities involve large-scale monitoring of individuals, or (iii) there is large-scale processing of sensitive personal data. This obligation applies regardless of whether the controller or processor is public or private. Non-compliance may trigger regulatory enforcement, including administrative penalties, orders to cease processing, depending on the severity and impact of the breach.

8.2 ARE THERE QUALIFICATION OR COMPETENCE CRITERIA FOR DATA PROTECTION OFFICERS?

Yes. A DPO must possess relevant academic or professional qualifications, which may include technical skills or demonstrable knowledge in data protection law and practices. However, the law does not prescribe minimum certifications or formal accreditation, offering flexibility for both legal and technical professionals to qualify.

8.3 What are the core responsibilities of a data protection officer?

The DPO is tasked with: (i) advising the controller or processor and their personnel on compliance with data protection obligations; (ii) monitoring internal compliance; (iii) providing guidance on data protection impact assessments; (iv) facilitating capacity building; and (v) cooperating with the regulatory authority on all matters relating to data protection.

8.4 Can the role of the data protection officer be outsourced? If so, what safeguards should be in place?

Yes. While the Proclamation does not explicitly reference outsourcing, it permits a single DPO to serve a group of entities, so long as the DPO is easily accessible by each entity. Similarly, a single DPO may be designated for several government bodies, taking into account their organizational structures. These provisions imply flexibility in appointment, including the potential for external DPOs. However, any appointed DPO will be required to have relevant academic or professional qualifications and must carry out their responsibilities without conflict of interest, even when fulfilling other tasks

8.5 WHAT ARE THE RECORD-KEEPING OBLIGATIONS FOR DATA CONTROLLERS AND PROCESSORS?

Data Processors and Controllers are required to keep a record of all processing operations, which includes details such as the nature, categories of data, and the recipients of the personal data. These records must be maintained and available for inspection by the supervisory authority as part of their broader accountability obligations. In addition to keeping records, they must also perform regular data protection impact assessments, implement internal policies, and verify the effectiveness of the security measures taken.

9. Data Security and Breach Response

9.1 WHAT SECURITY OBLIGATIONS APPLY TO THOSE HANDLING PERSONAL DATA?

Data controllers and processors must implement appropriate technical and organizational measures to ensure compliance with the Proclamation. These measures include ensuring data security and keeping records of processing operations, performing data protection impact assessments, and maintaining internal policies for verifying the effectiveness of the security measures

9.2 Are data breach notifications required under Ethiopian law? If so, who must be notified and what information must be disclosed?

Yes, data breach notifications are required. The data controller must notify the Authority within 72 hours of becoming aware of the breach. The notification must include:

• The nature of the breach, including categories and approximate number of data subjects affected.
• Contact details of the data protection officer or another contact point.
• Likely consequences of the breach.
• Measures taken to address the breach and mitigate its adverse effects.

9.3 Are data subjects required to be informed of a breach affecting their personal data? Under what conditions?

Yes, data subjects must be informed of a breach within 72 hours of the data controller becoming aware of it. The communication should clearly describe the breach's nature and include information such as the breach’s consequences and measures taken. However, notification is not required if:

• Appropriate security measures like encryption were applied to the affected data.
• Subsequent measures ensure the risk to the data subject’s rights is mitigated.
• It would involve disproportionate effort, and a public communication has been made instead.

9.4 What other risk mitigation practices should be adopted in the event of a breach?

In the event of a breach, controllers should ensure:

• Immediate notification to the Authority and affected data subjects as required.
• A thorough investigation into the breach, documenting the facts, effects, and remedial actions taken.
• Implementation of additional security measures to prevent future breaches and mitigate any potential adverse effects on data subjects.

10. Enforcement

10.1 What actions can the Authority take in the event of non-compliance? 
If the Authority believes that a data controller or processor has violated, is violating, or is about to violate the provisions of the Proclamation, it can issue an enforcement order. This order mandates the data controller or processor to take corrective steps within a specified period, which cannot be less than 21 days. The enforcement order is meant to ensure that compliance is achieved in a timely manner.

10.2 WHAT SPECIFIC DETAILS MUST BE INCLUDED IN AN ENFORCEMENT ORDER?

An enforcement order must clearly outline several key aspects. It should specify the exact provision of the Proclamation that has been, is being, or is likely to be violated. Additionally, the order must describe the corrective actions that need to be taken to rectify or prevent the contravention. The period for compliance must be at least 21 days, and the order must inform the recipient of their right to appeal. These requirements aim to provide transparency and clarity for the parties involved. 

10.3 How can individuals challenge decisions made by data controllers or processors?

Individuals who feel aggrieved by a decision made by a data controller or processor, in violation of the Proclamation, have the right to file an administrative complaint with the Authority. This complaint must be submitted within 21 days of the decision. Upon receiving the complaint, the Authority is obligated to investigate and issue a decision in writing within another 21 days. This process ensures that individuals have a formal avenue for seeking remedy if they believe their rights have been violated under the data protection laws.