DLA Piper Intelligence

Data Protection
Laws of the World

Law

Ethiopia
Ethiopia

Ethiopia has several laws that relate to privacy and data security, including the 1995 Constitution of the Federal Democratic Republic of Ethiopia, the 2005 Criminal Code of the Federal Democratic Republic of Ethiopia, the 1960 Civil Code, the Computer Crime Proclamation No. 958/2016 and the Freedom of the Mass Media and Access to Information Proclamation No. 590/2008.

Last modified 23 May 2019
Law
Ethiopia

Ethiopia has several laws that relate to privacy and data security, including the 1995 Constitution of the Federal Democratic Republic of Ethiopia, the 2005 Criminal Code of the Federal Democratic Republic of Ethiopia, the 1960 Civil Code, the Computer Crime Proclamation No. 958/2016 and the Freedom of the Mass Media and Access to Information Proclamation No. 590/2008.

Last modified 23 May 2019
Definitions

Definition of Personal Data

No specific definition is generally applicable. 

The Freedom of the Mass Media and Access to Information Proclamation No. 590/2008, applicable to government entities, is understood to generally define personal data as information about an identifiable individual that relates, but is not limited, to: 

  • medical, education, academic, employment, financial transaction, professional or criminal history
  • ethnic, national or social origin, age, pregnancy, marital status, color, sexual orientation, physical or mental health, well-being, disability, religion, belief, conscience, culture, language or birth
  • an identification number, symbol or other identifier assigned to the individual, address, fingerprints or blood type
  • personal opinions, views or preferences, except as relate to another individual
  • views or opinions on grant proposals, awards, or prizes granted to another individual, provided such views or opinions are not associated with the other individual’s name
  • views or opinions of others about the individual, or
  • an individual’s name, in combination with other personal data, or alone, if could reasonably be linked to personal data (exception applies for persons deceased for more than 20 years).

Definition of Sensitive Personal Data

Sensitive personal data is not defined.

Last modified 23 May 2019
Authority

There is no data protection authority.

Last modified 23 May 2019
Registration

There is no requirement to register databases or personal data processing activities.

Last modified 23 May 2019
Data Protection Officers

There is no requirement to appoint a data protection officer.

Last modified 23 May 2019
Collection & Processing

Though Ethiopia has not enacted a specific law to address personal data collection and processing issues, the country’s scattered legislative framework is understood to require that personal data be collected and processed with due care and only for an intended lawful purpose.

Last modified 23 May 2019
Transfer

No specific geographic transfer restrictions apply in Ethiopia. 

However, existing law provides that personal data transfers must be based on the prior written consent of the person whose data is to be transferred and only for an intended lawful purpose.

Last modified 23 May 2019
Security

There are no specific data security requirements. 

The Computer Crime Proclamation No. 958/2016 requires service providers to implement reasonable and necessary security measures to protect confidential computer traffic data disseminated through their computer systems or communications services from unlawful and unnecessary access.

Last modified 23 May 2019
Breach Notification

There is no general breach notification requirement in Ethiopia. 

However, the Computer Crime Proclamation No. 958/2016 requires service providers with knowledge that a crime stipulated by the Proclamation (including breach of privacy via unauthorized access) has been committed by a third party through the computer system it administers to immediately notify the Information Network Security Agency, report the crime to police, and take appropriate measures.

Last modified 23 May 2019
Enforcement

Ethiopian courts are responsible for enforcing data protection and privacy provisions in the law.  

Last modified 23 May 2019
Electronic Marketing

No specific law regulates electronic marketing in Ethiopia.

Last modified 23 May 2019
Online Privacy

There are several provisions in Ethiopian law to regulate online privacy. For example, the Computer Crime Proclamation No. 958/2016 criminalizes the unauthorized access to, and illegal interception and damage of, computer data. 

The Proclamation further prohibits the use of computer systems to disseminate advertisements absent addressee consent.

Last modified 23 May 2019
Contacts
Benyam Tafesse
Benyam Tafesse
Head, Employment, IP & Aviation Practices
Mehrteab Leul & Associates
T +251 115 159 798
Last modified 23 May 2019