Key Insights on Ethiopia’s Personal Data Protection Proclamation

February 18, 2025

In today’s digital age, data is at the core of our interconnected world. The sharing of data enhances convenience, efficiency, and connectivity in both personal and professional spheres. Ethiopia is no exception to this global trend, making the establishment of a comprehensive data protection framework essential. Recognizing this necessity, Ethiopia has enacted the Personal Data Protection Proclamation No. 1321/2024 to safeguard the rights, fundamental freedoms, and privacy of individuals regarding the automatic processing of personal data. Furthermore, the proclamation aims to foster a robust digital economy by building trust in data protection.

Definition of Personal Data

Under the proclamation, personal data refers to any information relating to an identified or identifiable natural person. Identification may occur directly or indirectly through references such as a name, identification number, location data, online identifiers, or factors specific to an individual’s physical, physiological, genetic, mental, economic, cultural, or social identity.

Regulatory Authority and Its Mandates

The Ethiopian Communications Authority (ECA) has been designated as the regulatory body responsible for overseeing the implementation of the proclamation. The Authority is entrusted with a broad range of responsibilities, inter-alia, including:

Regulating both private and public sector organizations in matters of data protection.
Ensuring compliance with the rights of individuals regarding their personal data.
Registering and revoking authorizations for data controllersand data processors.
Establishing procedures for obtaining, retaining, using, and disclosing personal information.
Handling complaints from individuals regarding the processing of their personal data.

Through these mandates, the Authority plays a crucial role in upholding individuals’ data protection rights while placing greater accountability on entities processing personal data.

Core Principles of Data Processing

The proclamation outlines key principles that entities processing personal data must adhere to. These include:

Lawfulness, Fairness, and Transparency: – Processing must be conducted in a lawful, fair, and transparent manner.
Purpose Limitation: – Data must be collected for a specified, explicit, and legitimate purpose.
Data Minimization: – Only necessary data should be collected and processed.
Accuracy:-Entities must ensure that personal data is accurate and up to date.
Integrity and Confidentiality:- Personal data must be securely processed to protect against unauthorized access, loss, or destruction.

Sensitive Personal Data and Stricter Regulations

The proclamation classifies certain types of personal data as sensitive personal data, which are subject to more stringent regulatory requirements. These, among other, include:

Racial or ethnic origin
Political opinions
Religious beliefs
Membership in trade unions
Physical and mental health conditions
Genetic information
Criminal records, including alleged offences, legal proceedings, and court decisions

Due to the potential greater risks associated with these categories, their processing is subject to heightened safeguards to ensure individuals’ rights and privacy are adequately protected.

Economic and Legal Implications

Implementing a robust data protection framework benefits not only individuals but also the economy. The proclamation fosters confidence in digital transactions, enabling businesses to operate securely in an increasingly data-driven environment. By ensuring compliance with international data protection standards, Ethiopia enhances its competitiveness in the global digital economy, attracting foreign investment and facilitating secure cross-border data flows.

Conclusion

The enactment of the Personal Data Protection Proclamation No.1321/2024 marks a significant step toward strengthening Ethiopia’s digital landscape. By establishing a legal framework for data protection, the country ensures that personal data is processed fairly, securely, and responsibly. As businesses and institutions adapt to these new requirements, compliance with the law will not only protect individuals but also drive innovation and economic growth in Ethiopia’s digital economy. For legal professionals, businesses, and individuals seeking guidance on data protection compliance, understanding this proclamation is crucial. Our law office remains committed to providing expert legal insights and advice on navigating the evolving data protection landscape.