Ethiopia

The scope test sits in Article 3(2) of Proclamation No. 1321/2024. Limb (b) is cumulative: 'It is not established in Ethiopia but uses equipment in Ethiopia for processing the data otherwise than for the purposes of transit through Ethiopia and has a representative established in Ethiopia.' That drafting makes the local representative a condition of being caught rather than an obligation imposed on those caught, which is the reverse of the European and Indian pattern. Do not plan around the gap: the government can close it by amendment, the criminal provisions bite on anyone in Ethiopia who sends data out unlawfully, and the separate Critical Infrastructure Cybersecurity Proclamation No. 1426/2026 is expressly extraterritorial, applying to designated Ethiopian critical infrastructure located outside the country and to anyone supplying cybersecurity products or services to it. Article 3(3) also confirms the law binds federal and regional government bodies and the Addis Ababa and Dire Dawa city administrations.

The duty is in Article 22, headed 'Data Sovereignty': every controller or processor 'shall ensure the storage, on a server or data center located in Ethiopia, of personal data collected or obtained locally'. There is no size threshold, no grace period and no exemption for cloud services. Article 22(2) hands the regulator a dormant switch: it is to designate categories of 'critical personal data' that may be processed only on a server or data centre in Ethiopia, on grounds of the strategic interests of the state. We found no such designation published as of 18 August 2026. Article 22(3) requires prior approval from the regulator for any cross-border transfer of sensitive personal data, and Article 2(5) defines sensitive data to include communications data, content and metadata. Sector by sector, checked 18 August 2026: - Telecoms: tighter. Under the SIM Card Registration Directive the regulator keeps a National Subscriber Registry on its own premises, and every operator must upload subscriber records to it within 72 hours. Communications content and metadata are sensitive data, so exporting them needs prior approval. - Commercial hosting: to store data in Ethiopia as a business you need a Data Center Service Provider licence or a Hosting Service Provider licence from the communications regulator. - Government: the national data centre and government cloud are run by the Ministry of Innovation and Technology and marketed on local data sovereignty. - Banking and payments: the central bank's information technology directive for banks requires a disaster recovery site detached from the main site, but we found no separate banking or payments localisation rule; the national rule applies anyway. - Securities: the capital market regulator's published directives cover offerings, dematerialisation and self-regulatory organisations; we found no data location rule. - Health, insurance, education, gaming and mapping: no separate location rule found on official sites, checked 18 August 2026. - Critical infrastructure: from July 2027 twelve sectors, including finance, health, energy and government services, pick up eighteen cybersecurity duties under a new proclamation.

The chain runs Articles 18 to 22 of Proclamation No. 1321/2024. Article 18 allows transfer only where the destination 'ensures appropriate levels of protection'. Article 19(5) is blunt: transfer to a jurisdiction that does not ensure an appropriate level of protection 'is prohibited'. Article 19(3) lets the regulator authorise a limited transfer anyway, if the person consents and the data is cut down. Article 20 sets the four gateways. Article 21 lets the regulator demand proof that your safeguards work and prohibit or suspend a transfer. Article 22(3) adds prior approval for sensitive data. The model is case-by-case approval, not an approved-country list and not a standard contract. There is no Ethiopian equivalent of European standard contractual clauses or binding corporate rules, no certification scheme, and we found no published finding that any country is adequate — the list, in effect, is empty. That leaves a hard practical problem: the mechanism the law depends on does not yet exist in usable form, while sending data out without it is a criminal offence carrying five to ten years' imprisonment.

Proclamation No. 1321/2024 defines 'Authority' as the Ethiopian Communications Authority, established under Communications Service Proclamation No. 1148/2019. The Authority's own about page states it 'serves as the national authority responsible for regulating and enforcing personal data protection in Ethiopia' and that it 'registers and supervises data controllers and processors'. Against that: its Resources page lists eleven telecoms directives from 2021 plus a fees directive, and under Laws it simply hosts a copy of the data protection proclamation, uploaded in October 2025; its Services page lists telecoms, postal and internet licences with no data controller registration; and its public notices in October and December 2025 concern interconnection offers by Ethio Telecom and Safaricom. Article 60(3) of the proclamation also says the detail of administrative offences and fines is to be set by a Council of Ministers regulation, and we found no such regulation, so the administrative fine machinery is not yet usable. The criminal offences in Article 64 do not depend on any regulation and are enforced by prosecutors and courts, not by the regulator. Other regulators are genuinely active in their own lanes: the National Bank of Ethiopia supervises bank technology risk, and the Information Network Security Administration publishes standards, controls technology imports and now administers the critical infrastructure regime.

Article 50 of Proclamation No. 1321/2024 imposes the duty to destroy, and requires deletion to be done so the record cannot be reconstructed in intelligible form; the controller must also tell every processor holding the data to do the same. Article 30 requires you to publish retention periods in your privacy notice. Article 23 keeps privacy rights alive for ten years after death, which affects deletion routines built for living users only. Article 46 leaves the retention period for access logs to be fixed by the regulator, and it has not fixed one, so log retention is currently undefined by law rather than unlimited. The SIM Card Registration Directive sets the three-month floor for deactivated subscribers. Ordinary commercial floors — tax, company and accounting records — almost certainly apply through Ethiopian tax and commercial law, but the Ministry of Revenue website would not serve to us during this run, so we do not assert a number.

Articles 43 and 44 of Proclamation No. 1321/2024 set the two 72-hour clocks and list what the notification must contain; a late notification must explain the delay, and processors must tell their controller without undue delay. Directive No. SBB/83/2022 requires a bank to notify the National Bank's Banking Supervision Directorate within two working days of any information technology incident that could have significant impact. Critical Infrastructure Cybersecurity Proclamation No. 1426/2026 requires notification to the National Computer Emergency Response Centre within 48 hours; it was published on 21 July 2026 and takes effect one year later. Under Article 64(1) of the privacy law, not notifying a breach, or not taking technical and organisational measures once one has happened, is punishable by one to three years' simple imprisonment or a fine of 60,000 to 100,000 birr, roughly 375 to 625 US dollars, or both.

(1) Article 33 requires a data controller or processor to be registered with the Authority in order to process personal data, with a certificate valid for two years; the Authority's own services list contains no such registration, so every organisation in the country is technically in breach. (2) Article 2(15) defines a minor as a data subject below the age of sixteen; Article 12 requires parental or guardian consent and restricts marketing and profiling of minors. (3) Article 64(3) makes re-identifying de-identified data, selling personal data, or transferring personal data outside Ethiopia in violation of the proclamation punishable by five to ten years' rigorous imprisonment and a fine of 200,000 to 600,000 birr, roughly 1,250 to 3,750 US dollars. Where the offender is an institution, or the case involves sensitive data or a minor, Article 60(2) allows an administrative fine of up to 4 per cent of total worldwide turnover for the preceding financial year, and any gain made goes to the government. (4) Article 2(5)(i) puts 'communications data, including content and metadata' inside the sensitive category, which pulls telecoms, messaging and email providers into the prior-approval regime of Article 22(3); the Authority may also add new categories of sensitive data at any time. (5) The Information Technology Products Security Clearance and Control Proclamation No. 1310/2023 requires a security clearance permit to import, export or use listed products, and the Information Network Security Administration publishes both lists: the restricted list includes servers above 5.0 GHz, high performance computing systems, network switches at or above 1 Tbps, firewalls at or above 20 Gbps and hardware security modules; the prohibited list includes low-earth-orbit satellite internet terminals and digital forensic tools. Both lists are populated today.

Dated: Proclamation No. 1426/2026 was done at Addis Ababa on 21 July 2026 and enters into force one year after publication in the Federal Negarit Gazette, so 21 July 2027. During the grace period the Information Network Security Administration says it will issue implementing directives and standards. Suppliers of cybersecurity products or services will need a licence, security clearance, minimum capital and a permanent address in Ethiopia. Dormant switches, any of which can change the picture with no consultation: (1) the Council of Ministers regulation on administrative offences and fines under Article 60(3), which would switch on the 4 per cent turnover penalty machinery; (2) the Authority's power under Article 69(2) to issue directives, including the registration requirements every organisation is already supposed to satisfy; (3) Article 22(2), which requires the Authority to designate categories of 'critical personal data' processable only inside Ethiopia — an unbounded local-only category that does not exist yet; (4) Article 2(5)(j), letting the Authority declare any other data sensitive, which would drag it into the prior-approval regime; (5) Article 46, the unset retention period for access logs; and (6) the Information Network Security Administration's prohibited and restricted technology product lists, which are administrative documents it can revise at will.