Data protection & privacy laws in Somalia (2026)

The Data Protection Act, 2023 is Somalia's first comprehensive data-protection law, regulating the collection, storage, processing, and transfer of personal data; it took effect on 23 March 2023.

The Somali Data Protection Authority (DPA) is the lead federal body mandated to implement and enforce the Act and to formulate national data-protection regulations; it was officially launched on 24 February 2024.

Individuals are granted rights to access, correct, and erase their data, withdraw consent, object to processing, and not be subject to decisions based solely on automated processing.

The Act sets lawful grounds for processing (including consent and public interest), requires data breach notification, and mandates that 'data controllers and processors of major importance' register with the Authority, renewable annually.

Transfers of personal data outside Somalia are restricted and permitted only where the recipient country or recipient ensures adequate protection via adequacy, binding corporate rules, contractual clauses, codes of conduct, or certification mechanisms.

Following the Act, the Authority issued an Implementation Regulation, DPA Guidance, and an Alternative Dispute Resolution Procedure to operationalise the law.