Data protection & privacy law in Ethiopia (2026)

The Ethiopian Communications Authority, designated as the data protection supervisory body under Proclamation 1321/2024, started hiring specialist staff, establishing a data-controller register, and drafting implementing directives. No enforcement actions or binding guidelines had been issued as of early 2025, but the ECA Director General publicly described the institution as building new 'muscle'.

Ethiopia's first comprehensive data protection law was published in the Federal Negarit Gazette, formally commencing its legal effect. It designated the Ethiopian Communications Authority as the sole supervisory authority and provided a transition period for existing data processors to achieve compliance.

Ethiopia's House of Peoples' Representatives enacted the country's first omnibus data protection law, modelled closely on the EU GDPR. It establishes individual rights (access, erasure, portability, objection), lawful-basis and consent requirements, protections for sensitive data, cross-border transfer restrictions, mandatory data breach notification, and administrative penalties up to 2% of annual global turnover.

Ethiopia legislated the Fayda programme — a national digital identity system collecting fingerprints, iris scans, and facial biometrics for all residents and assigning a unique 12-digit number. The Proclamation embedded consent-based processing and data-minimisation norms, and directly precipitated the urgency of the 2024 PDPP to protect the resulting mass biometric dataset.

The Ethiopian Communications Authority mandated telecom operators to obtain informed consent before processing subscriber data, share data with third parties only by court order or explicit subscriber consent, and process all consumer personal data exclusively on servers physically located within Ethiopia — the country's first sector-specific data localisation requirement.

Ethiopia's MInT released the first public draft of a comprehensive data protection bill for stakeholder consultation, signalling the government's formal intent to enact a standalone privacy law. The draft took four years to be finalised, reflecting the complexity of aligning the framework with the nascent digital economy and international standards.

Ethiopia created the ECA as an independent federal regulator, liberalising the previously state-monopoly telecom sector. This institutional creation is foundational to the current data-protection architecture: the 2024 PDPP later designated the ECA as the national data protection supervisory authority with investigatory and sanctioning powers.

Ethiopia's first cybercrime law criminalised unauthorised access, illegal data interception, data tampering, and computer fraud. Article 23 controversially required all ISPs and service providers to retain all communications data for at least one year and disclose it on court or prosecutor order — establishing broad state access to personal data well before any data-protection counterweight existed.

Ethiopia's first legislation to define 'personal data' in statute, enumerating categories including medical, financial, biometric, and opinion information held by public bodies, and requiring lawful-purpose collection with prior written consent. Though its scope was limited to public entities with weak enforcement, it became the definitional template adopted in the 2024 PDPP.

The Federal Democratic Republic of Ethiopia's Constitution came into force, with Article 26 guaranteeing every person the right to privacy of their person, home, and correspondence including electronic and telephone communications. This constitutional provision was the sole enforceable privacy protection in Ethiopia for over a decade before any sector-specific legislation followed.