Ethiopia Proclamation 1321/2024
Personal Data Protection Proclamation No. 1321/2024
Key Facts
Overview
Ethiopia's Personal Data Protection Proclamation 1321/2024 is the country's first comprehensive data protection law, effective July 24, 2024. Enforced by the Ethiopian Communications Authority (ECA), it establishes consent as the foundation for all data processing and mandates strict data localization requiring servers within Ethiopia. The law carries some of the harshest criminal penalties in Africa, with up to 10 years imprisonment for selling personal data and a 4% global turnover penalty for institutions.
What This Means for Your Website
If your website collects personal data from Ethiopian users, you must obtain consent before processing, store data on servers within Ethiopia, and report breaches within 72 hours. The law's data sovereignty principle and localization requirements may require infrastructure changes. Penalties are severe, with both criminal and administrative enforcement.
Key Requirements
Consent is required for all personal data processing. Data must be stored on servers within Ethiopia. Breaches must be reported within 72 hours. Processing must follow principles of lawfulness, proportionality, purpose limitation, and data minimization. Data subjects have rights to access, rectify, erase, and restrict processing. Data sovereignty is explicitly enshrined as a principle.
How ConsentStack Handles This
ConsentStack provides compliant consent collection for Ethiopia's Proclamation 1321/2024. The platform delivers a configurable consent banner, records all consent decisions with timestamps for ECA audit requirements, and supports data subject rights workflows. ConsentStack's consent logs provide the documentation needed to demonstrate lawful processing under the proclamation.
Penalties
1-3 years imprisonment or ETB 60,000-100,000; 3-5 years or ETB 100,000-200,000 (automated decision violations); 5-10 years or ETB 200,000-600,000 (unlawful cross-border transfers/selling data); up to 4% of global turnover for institutions
Key Requirements
- Consent required for all personal data processing
- Data localization: personal data must be stored on servers within Ethiopia
- 72-hour breach notification requirement
- Principles of lawfulness, proportionality, purpose limitation, data minimization, and accuracy
- Data subjects have rights to access, rectify, erase, and restrict processing
- Data sovereignty explicitly enshrined as a principle
Notable Provisions
- Among the harshest criminal penalties in Africa — up to 10 years for selling personal data
- Strict data localization requirement mandating Ethiopian servers
- 4% global turnover penalty for institutions mirrors GDPR levels
- Data sovereignty explicitly enshrined as a legal principle
Other Sub-Saharan Africa Regulations
Frequently Asked Questions
What are the penalties under Ethiopia's Proclamation 1321/2024?
Penalties range from 1-3 years imprisonment or ETB 60,000-100,000 for basic violations, up to 5-10 years or ETB 200,000-600,000 for selling data. Institutions face up to 4% of global turnover.
Does Ethiopia require data localization?
Yes, the proclamation mandates that personal data must be stored on servers physically located within Ethiopia.
When did Ethiopia's data protection law take effect?
The proclamation was approved April 4, 2024 and became effective July 24, 2024 upon publication in the Federal Negarit Gazette.
Who enforces Ethiopia's data protection law?
The Ethiopian Communications Authority (ECA) is the designated enforcing authority under Proclamation 1321/2024.
Stay compliant with Ethiopia Proclamation 1321/2024
ConsentStack helps you implement Opt-in consent for Federal Democratic Republic of Ethiopia automatically.