The new law sets standards for data privacy and security and creates an independent Data Protection Authority.
Somalia has enacted Law No. 5, the Public Data Protection Act. The law establishes a framework to protect personal data and to ensure that data is used fairly, lawfully, and securely.
The Act was enacted in response to the growing need to protect personal information in a digital age. Its purpose is to balance the benefits of data use with the fundamental rights and freedoms of individuals, in line with the Constitution.
Law No. 5, the Public Data Protection Act was enacted and entered into force on March 20, 2023.
As more of daily life moves online, personal data has become both valuable and vulnerable. This law was designed to give individuals confidence that their information will be handled responsibly and to give organisations clear rules to follow.
Article 3 (Objectives of the Law) sets out its aims of protecting personal data from misuse, promoting data security, and ensuring fair and lawful data use. Article 4 (Scope of the Law) provides that it applies to data controllers who reside, are based, or operate within Somalia.
The law creates an independent regulator to enforce these standards. Article 6 (Public Data Protection Authority) establishes an independent Authority with power to manage assets and take part in legal proceedings, and Article 7 (Duties and Functions) defines its role in promoting awareness and ensuring the law is implemented.
Safeguards protect the integrity of the system. Article 12 (Conflict of Interest) prevents the Authority's leaders and staff from holding interests in major data controllers, keeping enforcement impartial.
Core obligations protect individuals directly. Article 14 (Legality of the Use of Personal Data) requires that personal data be processed fairly and with consent, while Article 25 (Data Breach Notifications) requires controllers to notify the Authority of serious breaches within 72 hours.
This law is important because it gives individuals in Somalia meaningful control over their personal data for the first time. Clear consent rules, breach notification duties, and an independent regulator bring Somalia closer to international data protection standards.
“Strong data protection is now a foundation of any modern economy. By requiring consent, prompt breach reporting, and independent oversight, this law gives individuals real protection and gives businesses clear rules to follow. Practical compliance, through good data practices and timely reporting, is what will make these rights effective.”
, Dr. Abdiwahid Osman Haji, LL.M. (Master of Laws), LL.B. (Bachelor of Laws)
Managing Partner at Mogadishu Law Office
This release is provided for general information and does not constitute legal advice. Professional legal advice should be obtained before acting on any matter discussed here.