Data protection & privacy laws in Djibouti (2026)

The National Assembly passed the Digital Code on 30 June 2025, comprising nearly 800 articles across eight volumes. The personal data protection title is aligned with GDPR principles including lawful basis, data minimisation, and purpose limitation, making Djibouti the first East African state to enact such a code.

The Commission Nationale de Protection des Données Personnelles (CNDP) is designated as an independent body with administrative and financial autonomy, composed of representatives from the presidency, parliament, magistracy, relevant ministries, the human rights commission, and a business association. It was designated but not yet operationally established at the time of enactment.

Controllers must implement privacy by design and by default from the design stage, ensure only necessary data is processed, maintain processing records, and notify the CNDP of personal data breaches within 72 hours of becoming aware (unless the breach poses no risk).

Violations can attract criminal penalties of up to 10 years' imprisonment and administrative fines of up to 5% of global annual turnover — among the most stringent personal data protection sanctions enacted in Africa.

Djibouti ratified the African Union Convention on Cybersecurity and Personal Data Protection (Malabo Convention, adopted 2014) via Loi n° 18/AN/23/9ème L, published in the Journal Officiel, layering a continental data protection framework alongside the domestic Digital Code.

The data protection provisions apply to both automated processing and non-automated processing where data forms part of a structured filing system. Coverage extends to controllers established in Djibouti or processing personal data of residents of Djibouti.