Data protection & privacy law in Ethiopia (2026)
Data protection in Ethiopia: comprehensive law.
Ethiopia enacted its first comprehensive data protection law, Proclamation No. 1321/2024, approved by Parliament on 4 April 2024 and published in the Federal Negarit Gazette on 24 July 2024, entering into force immediately. The law imposes GDPR-influenced obligations on all public and private entities processing personal data in Ethiopia, with the Ethiopian Communications Authority designated as supervisory authority. As of early 2026, enforcement remains nascent: implementing directives are still pending ECA approval and no public enforcement actions have been recorded.
Legal framework
Personal Data Protection Proclamation No. 1321/2024; supervised by the Ethiopian Communications Authority (ECA)
Key points: data & privacy in Ethiopia
Proclamation enactment
Proclamation No. 1321/2024 was passed by the Federal House of Representatives on 4 April 2024 and gazetted on 24 July 2024, making it Ethiopia's first standalone, comprehensive personal data protection statute.
Supervisory authority
The Ethiopian Communications Authority (ECA) is the designated data protection regulator, responsible for maintaining a register of controllers and processors, investigating complaints, issuing enforcement notices, and imposing administrative fines.
Core principles & legal bases
Processing must comply with principles of lawfulness, proportionality, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality. Recognised legal bases include consent, contract performance, legal obligation, public-health emergency, public-authority mandate, and legitimate interest.
Data subject rights
Data subjects are granted rights to: be informed, access their data, rectification, erasure, objection to processing, restriction of processing, protection against solely automated decisions, and data portability.
Data localisation & cross-border transfers
Controllers and processors must store locally-collected personal data on servers or data centres physically located in Ethiopia. Cross-border transfer of sensitive personal data requires prior ECA approval; the ECA may designate certain categories as 'critical personal data' that must remain in-country.
Enforcement lag
As of early 2026, ECA has yet to publish implementing directives (four were in draft pipeline as of mid-2025) and no public enforcement actions have been recorded. A digital registration portal for controllers and processors was previewed but not yet operational, reflecting limited institutional capacity.
Timeline of decisions
- GuidanceECA Begins Building Enforcement Infrastructure Under PDPP
The Ethiopian Communications Authority, designated as the data protection supervisory body under Proclamation 1321/2024, started hiring specialist staff, establishing a data-controller register, and drafting implementing directives. No enforcement actions or binding guidelines had been issued as of early 2025, but the ECA Director General publicly described the institution as building new 'muscle'.
Digital Policy Alert (Graduate Institute Geneva)
- LawPersonal Data Protection Proclamation No. 1321/2024 Enters into Force
Ethiopia's first comprehensive data protection law was published in the Federal Negarit Gazette, formally commencing its legal effect. It designated the Ethiopian Communications Authority as the sole supervisory authority and provided a transition period for existing data processors to achieve compliance.
TBeST Law LLP
- Law · officialPersonal Data Protection Proclamation No. 1321/2024 Published in Federal Negarit Gazette
Ethiopia's first comprehensive data-protection statute entered into force, establishing consent-based processing rules, data-subject rights (access, rectification, erasure, restriction), a 72-hour breach-notification obligation, and extraterritorial reach over processors of Ethiopian residents' data. The Ethiopian Communications Authority was designated supervisory authority, with direct cybersecurity implications for any organisation handling personal data.
Ministry of Justice, Ethiopia
- LawParliament Adopts Personal Data Protection Proclamation No. 1321/2024
Ethiopia's House of Peoples' Representatives enacted the country's first omnibus data protection law, modelled closely on the EU GDPR. It establishes individual rights (access, erasure, portability, objection), lawful-basis and consent requirements, protections for sensitive data, cross-border transfer restrictions, mandatory data breach notification, and administrative penalties up to 2% of annual global turnover.
Digital Policy Alert
- LawDigital Identification Proclamation No. 1284/2023 Launches Fayda National Biometric ID
Ethiopia legislated the Fayda programme — a national digital identity system collecting fingerprints, iris scans, and facial biometrics for all residents and assigning a unique 12-digit number. The Proclamation embedded consent-based processing and data-minimisation norms, and directly precipitated the urgency of the 2024 PDPP to protect the resulting mass biometric dataset.
EthioData
- Law · officialDigital Identification Proclamation No. 1284/2023 Enacted
Ethiopia launched a mandatory biometric digital-identity system ('Fayda'), assigning a unique 12-digit number to all residents using fingerprint, iris, and facial data held in a central database, targeting 90 million enrolments. The system directly expands cybersecurity obligations for public bodies managing biometric infrastructure and intersects with the subsequent Personal Data Protection Proclamation.
Ministry of Justice, Ethiopia
- Decision · officialECA Issues Telecommunications Consumer Rights and Protection Directive No. 832/2021
The Ethiopian Communications Authority mandated telecom operators to obtain informed consent before processing subscriber data, share data with third parties only by court order or explicit subscriber consent, and process all consumer personal data exclusively on servers physically located within Ethiopia — the country's first sector-specific data localisation requirement.
Ethiopian Ministry of Justice
- GuidanceMinistry of Innovation and Technology Publishes Draft Personal Data Protection Proclamation
Ethiopia's MInT released the first public draft of a comprehensive data protection bill for stakeholder consultation, signalling the government's formal intent to enact a standalone privacy law. The draft took four years to be finalised, reflecting the complexity of aligning the framework with the nascent digital economy and international standards.
CIPIT, Strathmore University
- Law · officialFreedom of Mass Media and Access to Information Proclamation No. 590/2008
Ethiopia's first legislation to define 'personal data' in statute, enumerating categories including medical, financial, biometric, and opinion information held by public bodies, and requiring lawful-purpose collection with prior written consent. Though its scope was limited to public entities with weak enforcement, it became the definitional template adopted in the 2024 PDPP.
UNHCR Refworld
- Law · officialEthiopian Constitution Promulgated — Article 26 Enshrines Right to Privacy
The Federal Democratic Republic of Ethiopia's Constitution came into force, with Article 26 guaranteeing every person the right to privacy of their person, home, and correspondence including electronic and telephone communications. This constitutional provision was the sole enforceable privacy protection in Ethiopia for over a decade before any sector-specific legislation followed.
Ethiopian Human Rights Commission
- Law · officialEthiopian Constitution — Right to Privacy of Communications (Article 26)
The 1994 Constitution enshrined the right to privacy of all postal and electronic communications under Article 26, establishing the foundational constitutional norm against which all subsequent internet-surveillance and content-regulation laws would be benchmarked — and frequently found deficient by human-rights bodies.
WIPO Lex
Sources
- dataguidance.com/notes/ethiopia-data-protection-overview
- dataguidance.com/news/ethiopia-personal-data-protection-law-published
- metaappz.com/References/ethiopian_laws/federal/pr_1321_2024/en/txt
- dataguidance.com/sites/default/files/personal_data_protection_proclamation_1321-2024.p
- digitalpolicyalert.org/event/24922-implemented-personal-data-protection-proclamation-proclam
- digitalpolicyalert.org/change/12100-data-localisation-requirements-in-personal-data-protecti
- shega.co/news/one-year-on-ethiopia-s-personal-data-protection-law-faces-a-slow
- tbestlaw.com/ethiopias-personal-data-protection-proclamation-enters-in-to-force/
- kiyalaw.com/key-insights-on-ethiopias-personal-data-protection-proclamation/
- dlapiperdataprotection.com/index.html?t=law&c=ET
- mtalawoffice.com/insights-news/entry/ethiopia-s-new-data-protection-law-enhancing-priv
- haymanotbelay.com/banking-on-data-regulatory-expectations-for-data-storage-protection-a
Next for Ethiopia: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026