Ethiopia

The reach test sits in Proclamation No. 1321/2024. For a foreign company both conditions must be met. The company is not set up in Ethiopia, but uses equipment in Ethiopia to handle the data, other than simply passing it through the country. And it has a representative set up in Ethiopia. That wording makes having a local representative part of the test for being covered. In Europe and India, naming a representative is instead a duty for companies that are already covered. Do not plan around this gap. The government can close it by amendment. The criminal penalties apply to anyone in Ethiopia who sends data out unlawfully. And the separate Critical Infrastructure Cybersecurity Proclamation No. 1426/2026 applies even if you have no office there. It covers Ethiopian critical infrastructure located outside the country, and anyone supplying cybersecurity products or services to it. The privacy law also binds federal and regional government bodies, and the Addis Ababa and Dire Dawa city administrations.

The duty sits in a part of Proclamation No. 1321/2024 headed 'Data Sovereignty'. Everyone who handles personal data must 'ensure the storage, on a server or data center located in Ethiopia, of personal data collected or obtained locally'. There is no size limit, no grace period and no exemption for cloud services. The law also hands the regulator a power it has not used. It is meant to name categories of 'critical personal data'. Those may only be handled on a server or data centre in Ethiopia, on grounds of state strategic interests. We found no such list published as of 18 August 2026. The law also requires the regulator's approval in advance before sensitive personal data goes abroad. Sensitive data is defined to include communications data, both content and the details around it. Industry by industry, checked 18 August 2026: - Telecoms: tighter. Under the SIM Card Registration Directive the regulator keeps a National Subscriber Registry on its own premises. Every operator must upload subscriber records to it within 72 hours. Communications content and details are sensitive data, so sending them abroad needs approval first. - Commercial hosting: to store data in Ethiopia as a business you need a licence from the communications regulator. It is either a Data Center Service Provider licence or a Hosting Service Provider licence. - Government: the national data centre and government cloud are run by the Ministry of Innovation and Technology. They are marketed on keeping data in Ethiopia. - Banking and payments: the central bank's technology rules for banks require a disaster recovery site separate from the main site. We found no separate banking or payments rule about where data sits. The national rule applies anyway. - Securities: the capital market regulator's published rules cover offerings, electronic share records and self-regulatory organisations. We found no rule about where data sits. - Health, insurance, education, gaming and mapping: we found no separate rule about where data sits on official sites, checked 18 August 2026. - Critical infrastructure: from July 2027 twelve industries, including finance, health, energy and government services, take on eighteen cybersecurity duties under a new law.

Proclamation No. 1321/2024 sets out the chain. Data may go abroad only where the destination 'ensures appropriate levels of protection'. The law is blunt about the alternative: sending data to a country that does not ensure appropriate protection 'is prohibited'. The regulator can still allow a limited transfer if the person consents and the data is cut down. The law then sets four exceptions, lets the regulator demand proof that your protections work, and lets it ban or suspend a transfer. Sensitive data needs approval in advance on top of all this. The regulator decides each case one by one. There is no approved-country list and no standard contract. Ethiopia has no equivalent of Europe's standard contract clauses or group-wide internal rules, and no certification scheme. We found no published decision that any country is safe enough, so that list is empty. That leaves a real problem. The route the law depends on does not yet exist in a usable form. Meanwhile sending data out without it is a crime carrying five to ten years in prison.

Proclamation No. 1321/2024 names the Ethiopian Communications Authority as the regulator. That body was set up under Communications Service Proclamation No. 1148/2019. Its own about page says it 'serves as the national authority responsible for regulating and enforcing personal data protection in Ethiopia'. It also says it registers and supervises the organisations that handle personal data. The evidence says otherwise. Its Resources page lists eleven telecoms rules from 2021 plus a fees rule. Under Laws it simply hosts a copy of the privacy law, uploaded in October 2025. Its Services page lists telecoms, postal and internet licences, with no way to register as a company handling personal data. Its public notices in October and December 2025 concern interconnection offers by Ethio Telecom and Safaricom. The privacy law also says the detail of administrative offences and fines is to be set by a Council of Ministers regulation. We found no such regulation, so the administrative fine machinery is not yet usable. The criminal penalties do not depend on any regulation. They are enforced by prosecutors and courts, not by the regulator. Other regulators are active in their own areas. The National Bank of Ethiopia supervises bank technology risk. The Information Network Security Administration publishes standards, controls technology imports, and now runs the critical infrastructure rules.

Proclamation No. 1321/2024 sets the duty to destroy. Deletion must be done so the record cannot be rebuilt into readable form. You must also tell everyone else holding the data on your behalf to do the same. You must publish your keep-times in your privacy notice. Privacy rights stay alive for ten years after death, which affects deletion routines built only for living users. The law leaves the keep-time for access logs to the regulator, and the regulator has not set one. So log keep-times are undefined by law, not unlimited. The SIM Card Registration Directive sets the three-month minimum for switched-off subscribers. Ordinary business minimums for tax, company and accounting records almost certainly apply through Ethiopian tax and commercial law. The Ministry of Revenue website would not load for us, so we do not state a number.

Proclamation No. 1321/2024 sets the two 72-hour deadlines and lists what your notice must contain. A late notice must explain the delay. If you handle data on someone else's behalf, you must tell them without undue delay. Directive No. SBB/83/2022 requires a bank to notify the National Bank's Banking Supervision Directorate within two working days of any technology incident that could have significant impact. The Critical Infrastructure Cybersecurity Proclamation No. 1426/2026 requires notice to the National Computer Emergency Response Centre within 48 hours. It was published on 21 July 2026 and takes effect one year later. Under the privacy law, not reporting a breach is a crime. So is failing to take technical and organisational steps once a breach has happened. The penalty is one to three years' simple imprisonment, or a fine of 60,000 to 100,000 birr, roughly 375 to 625 US dollars, or both.

(1) The privacy law says you must be registered with the Authority before you handle personal data. The certificate lasts two years. The Authority's own services list contains no such registration. So every organisation in the country is technically in breach. (2) The law defines a child as anyone under sixteen. It requires parent or guardian consent, and limits marketing and profiling aimed at children. (3) Three acts carry five to ten years' rigorous imprisonment plus a fine of 200,000 to 600,000 birr, roughly 1,250 to 3,750 US dollars. Those are re-identifying data that had names stripped out, selling personal data, and sending personal data outside Ethiopia against the law. The law adds an administrative fine of up to 4 per cent of total worldwide turnover for the previous financial year. That applies if the offender is an organisation, or if the case involves sensitive data or a child. Any money made from the offence goes to the government. (4) The law puts 'communications data, including content and metadata' inside the sensitive category. That pulls telecoms, messaging and email providers into the rule requiring approval in advance. The Authority may also add new categories of sensitive data at any time. (5) The Information Technology Products Security Clearance and Control Proclamation No. 1310/2023 requires a security clearance permit to import, export or use listed products. The Information Network Security Administration publishes both lists. The restricted list includes servers above 5.0 GHz, high performance computing systems, network switches at or above 1 Tbps, firewalls at or above 20 Gbps, and hardware security modules. The prohibited list includes low-earth-orbit satellite internet terminals and digital forensic tools. Both lists have entries on them today.

Dated. Proclamation No. 1426/2026 was signed at Addis Ababa on 21 July 2026. It comes into force one year after publication in the Federal Negarit Gazette, so 21 July 2027. During that year the Information Network Security Administration says it will issue detailed rules and standards. Suppliers of cybersecurity products or services will need a licence, security clearance, minimum capital and a permanent address in Ethiopia. Powers that could be used at any time, with no consultation. (1) The Council of Ministers regulation on administrative offences and fines. Issuing it would switch on the 4 per cent turnover penalty. (2) The Authority's power to issue rules, including the registration requirements every organisation is already supposed to meet. (3) The duty on the Authority to name categories of 'critical personal data' that may only be handled inside Ethiopia. That category has no size limit and does not exist yet. (4) The Authority's power to declare any other data sensitive, which would drag it into the approval-in-advance rules. (5) The unset keep-time for access logs. (6) The Information Network Security Administration's prohibited and restricted technology product lists, which it can revise at will.