Cybersecurity law & regulation in Ethiopia (2026)
Cybersecurity in Ethiopia: sectoral rules.
Ethiopia's cybersecurity regime rests on the 2016 Computer Crime Proclamation (criminalising illegal access, interception, and damage to critical systems) and the 2024 Personal Data Protection Proclamation (requiring 72-hour breach notification to the Ethiopian Communications Authority). INSA, the national cybersecurity authority, currently exercises sector-specific oversight over finance and electric power, and a new Draft Critical Infrastructure Proclamation, expanding protection to 11 sectors, is before parliament and widely expected to be enacted soon.
Legal framework
Computer Crime Proclamation No. 958/2016; Personal Data Protection Proclamation No. 1321/2024; Information Network Security Administration (INSA) oversight, with a Draft Critical Infrastructure Cybersecurity Proclamation currently under parliamentary review
Key points: cybersecurity in Ethiopia
Computer Crime Proclamation 958/2016
The foundational cybersecurity/cybercrime law in force since July 2016 criminalises unauthorised access, interception, data interference, and system damage; it imposes enhanced penalties (up to 20 years and ETB 500,000 fine) for offences targeting critical infrastructure, and requires service providers to retain computer data for at least one year.
Personal Data Protection Proclamation 1321/2024
Ethiopia's first comprehensive data-protection law (enacted April 2024, gazetted July 2024) mandates 72-hour breach notification to the Ethiopian Communications Authority (ECA), mirrors GDPR security principles, and imposes fines of ETB 60,000-100,000 or 1-3 years' imprisonment for failure to notify breaches or implement required safeguards.
INSA and national cybersecurity operations
The Information Network Security Administration (INSA) serves as Ethiopia's primary cybersecurity authority, operating a 24/7 National Cybersecurity Operations Center, setting Critical Mass Cybersecurity Standards (CMCSS), and currently focusing mandatory audit and oversight obligations on financial institutions and the electric power sector.
Draft Critical Infrastructure Cybersecurity Proclamation (pending)
A Draft Critical Infrastructure Cybersecurity Proclamation, drafted by INSA after more than two years of review at the Ministry of Justice, is before parliament as of 2024-2025. It would designate 11 critical sectors (finance, telecoms, transport, health, education, water, agriculture, trade, government services, electric power, communications) and subject them to mandatory INSA cybersecurity audits.
Breach notification and incident reporting
Under PDPP 1321/2024, data controllers and processors must notify the ECA within 72 hours of becoming aware of a personal data breach. Under the 2016 Proclamation, service providers must disclose retained traffic and content data on court or prosecutor order; emergency real-time surveillance without a warrant is permitted when an imminent attack is suspected.
Threat environment and enforcement gaps
Ethiopia was ranked the world's most cyberattack-targeted country in 2024, with INTERPOL's 2025 Africa Cyberthreat Assessment reporting it leads globally in malware detections; INSA handled 8,854 data breach cases in 2024. Despite the PDPP entering force in 2024, as of early 2025 the ECA has not published implementing guidelines or taken public enforcement actions.
Timeline of decisions
- DecisionINSA Thwarts 27,505 Cyberattacks in First Half of FY 2025/26
Ethiopia's Information Network Security Administration reported neutralising 27,505 cyberattack attempts in the first six months of FY 2025/26 (July-December 2025), blocking 99.03% of all attacks. The surge reflects AI-driven, multi-vector adversarial techniques and underscores INSA's growing operational tempo.
APA News
- IncidentEthiopia Identified as Top Global Cyberattack Target Amid Digital Expansion
Ethiopia was ranked the most targeted country for cyberattacks globally, driven by rapid digital-government expansion and e-service rollout. The designation accelerated INSA investment in defensive infrastructure and prompted parliamentary discussion on tightening critical-infrastructure obligations.
Capital Newspaper Ethiopia
- DecisionINSA Deploys Indigenous Sovereign Applications (Ergamail, Serkuni, Debo)
INSA began rolling out domestically developed secure applications, Ergamail (email), Serkuni (collaboration), and Debo (data sharing), across government entities to replace foreign tools such as Gmail and Microsoft Teams, advancing digital sovereignty and reducing foreign supply-chain risk.
Capital Newspaper Ethiopia
- DecisionINSA Annual Report: 8,854 Attacks Blocked; Data-Breach Investigations Concluded
INSA's FY 2023/24 report recorded 8,854 cyberattack attempts thwarted (up from 6,959 the prior year) and announced conclusions to multiple public-sector data-breach investigations. INSA also identified 657 risk-level gaps across 123 critical-infrastructure providers, attributing them to financial constraints and insufficient in-house expertise.
Digital Policy Alert
- GuidanceRevised National Cybersecurity Policy 2024 Adopted
The Council of Ministers simultaneously approved an updated National Cybersecurity Policy, updated to address AI-enabled threats and providing the first explicit policy authorisation for AI tools in government surveillance and threat detection. The policy assigns INSA primary technical responsibility, mandates a National Cyber Security Council, and formalises a public-private-academic coordination model.
CyberMela Ethiopia
- Guidance · officialNational Cybersecurity Policy 2024 Adopted
Ethiopia adopted a revised National Cybersecurity Policy structured around eight pillars, legal frameworks, awareness, capacity building, research, digital-identity protection, critical-infrastructure protection, national coordination, and international cooperation, aligning with the Digital Ethiopia 2030 Strategy and INSA's expanded mandate.
Information Network Security Administration (INSA)
- DecisionINSA Reports 6,700+ Cyberattacks Foiled in FY 2022/23
INSA's annual report for FY 2022/23 documented more than 6,700 cyberattack attempts blocked against government and financial-sector systems. The report marked the first public disclosure of the scale of attack volume and reinforced calls for mandatory security standards across critical-infrastructure operators.
Ethiopian Monitor
- Law · officialComputer Crime Proclamation No. 958/2016 Enters into Force
Ethiopia's first comprehensive cybercrime law criminalised illegal access, data interference, misuse of computer systems and attacks on critical digital infrastructure, with penalties up to 20 years' imprisonment and fines up to 500,000 Birr for the most severe offences. Predating Ethiopia's AI policy by nearly a decade, this law established INSA and federal police as primary digital-crime enforcement authorities and created the legal baseline that later AI and cybersecurity policies built upon.
ILO NATLEX
- LawComputer Crime Proclamation No. 958/2016 Enters into Force
Ethiopia's first cybercrime law criminalised unauthorised access, illegal data interception, data tampering, and computer fraud. Article 23 controversially required all ISPs and service providers to retain all communications data for at least one year and disclose it on court or prosecutor order — establishing broad state access to personal data well before any data-protection counterweight existed.
ICT Policy Africa
- Law · officialComputer Crime Proclamation No. 958/2016 Enacted
Ethiopia's first comprehensive cybercrime law criminalised unauthorised computer access, data damage, cyber fraud, child pornography, cyber-terrorism and attacks on critical infrastructure with severe penalties. Internet service providers must retain all traffic data for at least one year and produce it on court or public-prosecutor order, laying the legal basis for state-mandated data retention.
Council of Europe Octopus Cybercrime Community
- Law · officialTelecom Fraud Offence Proclamation No. 761/2012 Enacted
Ethiopia's first targeted network-security statute criminalised unauthorised access to, interception of, and interference with telecommunication systems, and outlawed SIM-card cloning and subscriber-data manipulation. Although limited in scope, it established the legislative principle of digital-network protection and foreshadowed the broader 2016 Computer Crime Proclamation.
Federal Supreme Court of Ethiopia
- DecisionInformation Network Security Administration (INSA) Established by Council of Ministers Regulation No. 130/2007
Ethiopia created INSA as the national signals intelligence and cybersecurity agency, mandated to protect national information infrastructure and serve as the government's technical authority on information security. INSA became, and remains, the institutional cornerstone for all cybersecurity regulation, enforcement, incident response, and technical standard-setting in Ethiopia.
Wikipedia / Council of Ministers Regulation No. 130/2007
Sources
- digitalpolicyalert.org/event/28272-computer-crime-proclamation-no-9582016-including-cybersec
- ictpolicyafrica.org/es/document/2myzh44hf4y
- mondaq.com/privacy-protection/1766200/ethiopian-personal-data-protection-law-pro
- dlapiperdataprotection.com/?c=ET&t=breach-notification
- insa.gov.et/
- techreviewafrica.com/news/5283/ethiopia-reviews-draft-cybersecurity-proclamation-to-protec
- thereporterethiopia.com/50524/
- shega.co/news/one-year-on-ethiopia-s-personal-data-protection-law-faces-a-slow
- capitalethiopia.com/2026/01/25/ethiopia-faces-alarming-surge-in-cyberattacks-targeting-cr
- digitalpolicyalert.org/digest/dpa-digital-digest-ethiopia
- fanamc.com/english/insas-cybersecurity-initiatives-empowering-ethiopias-digital-
Next for Ethiopia: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026