Data protection
The Proclamation, signed on 24 July 2024 and in force from publication (Art. 70), applies to processing by automated means and to data in a filing system, by controllers established in Ethiopia or using equipment in Ethiopia through a local representative (Art. 3(1) and (2)); it does not apply to processing by an individual in the course of purely personal or household activity (Art. 3(4)(a)). The Authority is the Ethiopian Communications Authority created by Communications Proclamation No. 1148/2019, and the Ministry of Innovation and Technology formulates policy (Arts. 2 and 4). 'Sensitive personal data' includes ethnic origin, genetic and biometric data, health, political opinions, religious beliefs, offences and 'communications data, including content and metadata', and its processing is prohibited unless an exception such as the person's written, purpose-specific consent applies (Art. 9). Article 26(2) of the Constitution separately makes the inviolability of correspondence and of communications by telephone, telecommunications and electronic devices a constitutional right.
Consent must be free, informed, specific, clear and given by an active action; it can be withdrawn at any time, the controller bears the burden of proving it and the request cannot be bundled with other terms (Art. 8). A minor is a data subject under sixteen: processing needs consent given or authorised by a parent, guardian or tutor, the controller must make reasonable efforts to verify age, and processing a minor's data for marketing, profiling or merging profiles is not allowed (Art. 11). Locally collected data must be stored on a server or data centre in Ethiopia, the Authority may designate 'critical personal data' that may only be processed there, and cross-border transfer of sensitive data needs the Authority's prior approval (Art. 22). Privacy rights survive death for ten years and the lawful heir may invoke them (Art. 23).
The rights of data subjects are set out in Arts. 24 to 32: to be informed of the controller, purposes, recipients and retention periods (Art. 24); of access, free of charge, in electronic or hard copy (Art. 25); to rectification (Art. 27); to erasure where the data are no longer necessary, consent is withdrawn, the person objects or the processing is unlawful (Art. 28); to object, including to direct marketing (Art. 29); to restriction (Art. 30); not to be subject to a decision based solely on automated processing, with human intervention (Art. 31); and to portability in a structured, machine-readable format (Art. 32). Controllers and processors must register with the Authority, the certificate being valid for two years (Arts. 33 and 35(2)), must appoint a data protection officer if they are a government body or process sensitive data or monitor people on a large scale (Art. 40), and must notify the Authority and the data subject of a breach within 72 hours (Arts. 43 and 44).
Enforcement has three levels. A data subject may complain in writing to the Authority, which investigates and must notify the decision within 21 days; the decision can be appealed to the Federal High Court within 60 days (Art. 58). Anyone may also make an administrative complaint within 21 days of a controller's decision, on which the Authority decides in writing within a further 21 days (Art. 61). The Authority may serve an enforcement order giving at least 21 days to comply (Art. 55) and impose fines up to four per cent of worldwide turnover on institutions or for offences concerning sensitive data or a minor's data (Art. 60(2)). Criminal penalties are graded in Art. 64: one to three years or a fine of 60,000 to 100,000 Birr for failing to notify a breach or processing unlawfully; three to five years or 100,000 to 200,000 Birr for refusing to erase data, respect an objection or respect the right against automated decisions; five to ten years or 200,000 to 600,000 Birr for re-identifying data, selling or offering to sell personal data or transferring it abroad unlawfully.
Other texts reach conduct that harms a partner or former partner online. Article 11 of the Computer Crime Proclamation No. 958/2016 punishes obtaining, selling, possessing or transferring another person's electronic-identity data without authorisation with simple imprisonment up to five years or a fine up to 50,000 Birr, and Art. 13 punishes online threats and repeated fear-causing messages (up to five or ten years where serious) and, upon complaint, defamatory online content (simple imprisonment up to three years or a fine up to 30,000 Birr). The Hate Speech and Disinformation Prevention and Suppression Proclamation No. 1185/2020 sets up to two years or 100,000 Birr for hate speech, up to one year or 50,000 Birr for disinformation, and up to three years or 100,000 Birr where the post is made through a social media account with more than 5,000 followers or through broadcast or print media (Art. 7).
Key points
| Statute | Personal Data Protection Proclamation No. 1321/2024, Federal Negarit Gazette No. 35, 24 July 2024 |
|---|---|
| Regulator | Ethiopian Communications Authority (Communications Proclamation No. 1148/2019); policy by the Ministry of Innovation and Technology (Arts. 2 and 4) |
| Minor | A data subject under 16; parental or guardian consent; no marketing or profiling of minors (Arts. 2 and 11) |
| Registration | Compulsory for controllers and processors; certificate valid 2 years (Arts. 33 and 35) |
| Breach notification | To the Authority and the data subject within 72 hours (Arts. 43 and 44) |
| Complaint to the Authority | In writing; decision notified within 21 days; appeal to the Federal High Court within 60 days (Art. 58) |
| Administrative fine | Up to 4% of worldwide turnover for institutions, sensitive data or minors' data (Art. 60(2)) |
| Selling or offering to sell personal data | Serious imprisonment of 5 to 10 years or fine of 200,000 to 600,000 Birr, or both (Art. 64(3)) |
| Electronic identity theft | Simple imprisonment up to 5 years or fine up to 50,000 Birr (Computer Crime Proclamation Art. 11) |
In practice
- Ask the controller in writing for access to your data: the right of access is free of charge and the answer can be in electronic or hard copy (Art. 25); a refusal must be in writing with detailed reasons, and the burden of proving an exemption lies on the controller (Arts. 26 and 63).
- If the controller does not put matters right, complain in writing to the Ethiopian Communications Authority (Art. 58); its published address is Bole Sub-city, Woreda 03, House No. 2483, Robel Plaza, Addis Ababa. The Authority's website, searched on 12 October 2026, shows the Proclamation but no data-protection directive or complaint form.
- Lodge any administrative complaint against a controller's decision within 21 days of that decision (Art. 61).
- Report a sale, leak or misuse of your data to the police as an offence under Art. 64, and online threats or identity theft under the Computer Crime Proclamation (Arts. 11 and 13); keep screenshots and messages, because service providers must retain traffic data for one year (Art. 24 of that Proclamation).
Recent changes
The Authority's own website lists the Proclamation among its laws, in an official PDF uploaded in October 2025, but a search of the site on 12 October 2026 returned no data-protection directive or regulation, although Arts. 33(3), 35(3), 60(3) and 69 leave registration requirements, the detail of administrative fines and implementing rules to a directive or regulation.
Where to go
- Ethiopian Communications Authority, Bole Sub-city, Woreda 03, House No. 2483, Robel Plaza, Addis Ababa, for complaints under Art. 58.
- Federal High Court, for appeals against the Authority's decisions (Art. 58(3)) and as first-instance court for computer crimes (Computer Crime Proclamation Art. 40).
- Police and the public prosecutor, who jointly investigate computer crimes under the prosecutor's lead (Computer Crime Proclamation Art. 23); INSA's Ethio-CERT for cyber incidents.
Worth knowing
The definition of sensitive data includes communications content and metadata, and a controller that processes it without a valid exception can face a fine of up to four per cent of worldwide turnover (Arts. 2, 9 and 60(2)); on the other hand a person keeping data only for purely personal or household purposes is outside the Proclamation (Art. 3(4)(a)).
Frequently asked questions
Who enforces data protection in Ethiopia?
The Ethiopian Communications Authority, the body created by Communications Proclamation No. 1148/2019, enforces Proclamation No. 1321/2024, keeps the register of controllers and processors, investigates complaints and may serve enforcement orders and impose fines (Arts. 2, 5, 55 and 60).
Can I ask a company in Ethiopia to delete my data?
Yes: Art. 28 gives a right to erasure, free of charge and without excessive delay, where the data are no longer necessary, consent is withdrawn, the person objects without overriding grounds or the processing was unlawful, subject to exceptions such as public-health and legal-claim purposes.
What is the penalty for selling personal data?
Serious imprisonment of five to ten years or a fine of 200,000 to 600,000 Birr, or both, under Art. 64(3)(c) of the Proclamation, and up to four per cent of worldwide turnover if committed by an institution or concerning sensitive data or a minor (Art. 64(4)).
Sources
- Personal Data Protection Proclamation No. 1321/2024, Federal Negarit Gazette No. 35, 24 July 2024 (official PDF on the Ethiopian Communications Authority website) — Arts. 2, 3, 4, 5, 8, 9, 11, 22 to 33, 35, 40, 43, 44, 55, 58 to 64, 69 and 70 (English and Amharic text)
- Constitution of the Federal Democratic Republic of Ethiopia, 1995 (Constitute Project text; the Amharic version has final legal authority, Art. 106) — Art. 26: privacy, inviolability of correspondence and electronic communications
- Computer Crime Proclamation No. 958/2016, Federal Negarit Gazette No. 83, 7 July 2016 (English and Amharic text) — Arts. 11, 13, 23, 24 and 40
- Hate Speech and Disinformation Prevention and Suppression Proclamation No. 1185/2020, Federal Negarit Gazette No. 26, 23 March 2020 (ARTICLE 19 copy) — Art. 7: criminal liability for hate speech and disinformation
- Ethiopian Communications Authority -- resources page (laws section) and site search for data-protection directives — Proclamation listed among the Authority's laws; address of the Authority; no directive found on 12 October 2026
- Ethiopian Communications Authority -- consumer affairs page (complaints handling and dispute resolution) — 'privacy violations' among telecom consumer complaints, a separate procedure from Art. 58
The general article: Data protection · Compare with another country
Romance scams
Article 10(1) of the Computer Crime Proclamation punishes with rigorous imprisonment up to five years and a fine up to 50,000 Birr whoever fraudulently causes a person to act to his prejudice by distributing misleading computer data, misrepresenting his status, concealing facts he had a duty to reveal or taking advantage of the person's erroneous beliefs; Art. 10(2) punishes causing economic loss by altering or deleting data with fraudulent intent, with up to five years and 10,000 to 50,000 Birr, or up to ten years and 10,000 to 100,000 Birr in serious cases. Article 11 punishes obtaining or transferring another person's electronic identity data, and Art. 9 forging computer data. The Criminal Code adds Art. 692, fraudulent misrepresentation to obtain an unlawful enrichment (simple imprisonment or rigorous imprisonment up to five years and a fine; Art. 696 raises this to fifteen years and 50,000 Birr only for a person in a position of trust, a seller of shares or securities, or fraud against public administrations) and Art. 701(1): collecting money by falsely claiming to have a serious disease or to have suffered grave injury or loss, or by other fraudulent means appealing to compassion, punishable by simple imprisonment and fine or rigorous imprisonment up to five years and a fine.
Romance fraud has a specific echo in the Code's offences against marriage: procuring a marriage by intentional misrepresentation, error, fraud or deceit as to one's identity is punishable upon complaint with simple imprisonment up to one year or a fine up to 1,000 Birr (Art. 646(2)), and concealing from a spouse a fact that would annul the marriage with simple imprisonment up to two years or a fine up to 5,000 Birr (Art. 646(1)), although no proceedings may be brought unless the marriage has been annulled (Art. 649). Threatening to reveal a fact injuring honour to obtain a demand is punishable upon complaint (Art. 581), and extorting by online threats falls under Art. 13 of the Computer Crime Proclamation.
Telecom fraud has its own statute. Under Art. 10(1) of the Telecom Fraud Offence Proclamation No. 761/2012, manipulating or duplicating SIM cards, credit cards or subscriber identification data, or selling duplicated ones, carries rigorous imprisonment of ten to fifteen years and a fine of 100,000 to 150,000 Birr, and obtaining telecom service by a forged contract or by fraudulently using another person's identity code carries three to eight years and 30,000 to 80,000 Birr (Art. 10(2)(b)). Article 5 of that Proclamation was repealed by the Computer Crime Proclamation (Art. 45).
Cross-border cases follow set rules. The Federal High Court has first-instance jurisdiction over computer crimes (Computer Crime Proclamation Art. 40); the public prosecutor and police investigate jointly under the prosecutor's lead (Art. 23); the Federal Attorney General cooperates with foreign authorities, including joint investigations and extradition within the limits of the Ethiopian legal system (Art. 42); and the Criminal Code applies to a crime committed outside Ethiopia against an Ethiopian national if it is prohibited in both countries and serious enough to justify extradition (Art. 18(1)). No Ethiopian national may be extradited to another state (Nationality Proclamation No. 378/2003, Art. 15).
Where money moved through a bank, the National Bank of Ethiopia's Financial Consumer Protection Directive No. FCP/01/2020 requires the complaint to go to the financial service provider first; if the customer is unsatisfied, or the provider has not answered within ten business days, the customer may file with the Bank's consumer protection department with the provider's reply and the supporting records. The Bank's page gives 6230 as its hotline. INSA's website invites any institution, company or individual that suffers a cyber attack to report it through its 'Report a cyber issue' link to the Ethio Cyber Emergency Response Team.
Key points
| Computer-related fraud | Rigorous imprisonment up to 5 years and fine up to 50,000 Birr (Computer Crime Proclamation Art. 10(1)) |
|---|---|
| Fraud causing economic loss by altering data | Up to 5 years and 10,000 to 50,000 Birr; up to 10 years and 10,000 to 100,000 Birr if serious (Art. 10(2)) |
| Electronic identity theft | Simple imprisonment up to 5 years or fine up to 50,000 Birr (Art. 11) |
| Fraudulent misrepresentation | Simple or rigorous imprisonment up to 5 years and fine (Criminal Code Art. 692); up to 15 years only for positions of trust, securities or public bodies (Art. 696) |
| Money collected by false claims of illness or loss | Simple imprisonment and fine, or rigorous imprisonment up to 5 years and fine (Art. 701(1)) |
| Marriage procured by deceit about identity | Upon complaint: simple imprisonment up to 1 year or fine up to 1,000 Birr (Art. 646(2)) |
| Duplicating SIM cards or subscriber data | Rigorous imprisonment of 10 to 15 years and fine of 100,000 to 150,000 Birr (Telecom Fraud Offence Proclamation Art. 10(1)) |
| Court | Federal High Court at first instance (Computer Crime Proclamation Art. 40) |
| Bank complaint | Provider first; National Bank of Ethiopia after unsatisfactory reply or 10 business days (Directive FCP/01/2020) |
In practice
- Do not send money to someone you have not met: Art. 701(1) of the Criminal Code describes exactly the request for funds based on false claims of illness, injury or loss.
- Keep the profile, messages, payment receipts and account numbers, then make the criminal complaint at a police station; computer crimes are investigated jointly by police and prosecutor (Computer Crime Proclamation Art. 23).
- If the money left through a bank or mobile account, complain first to your financial service provider, then, after ten business days or an unsatisfactory reply, to the National Bank of Ethiopia (hotline 6230 on its website).
- Report the incident to INSA's Ethio-CERT through the 'Report a cyber issue' link on the INSA website (+251-11-371-7114).
Where to go
- Police station and public prosecutor, for the criminal complaint.
- INSA and the Ethio Cyber Emergency Response Team, Addis Ababa (Welo Sefer, China Street), +251-11-371-7114, contact@insa.gov.et.
- National Bank of Ethiopia, Sudan Street, Addis Ababa, hotline 6230, for unresolved complaints against banks and other financial providers.
- Ethiopian Communications Authority, for telecom consumer complaints after the operator's own procedure (ten working days to resolve, then up to thirty working days to file).
Worth knowing
Art. 646 punishes deceit about identity only to procure a marriage, and no proceedings may be brought under Arts. 646 or 647 unless the marriage has been annulled (Art. 649); a fraud that is not aimed at marriage is prosecuted under the fraud offences of Art. 692 or Art. 10 of the Computer Crime Proclamation.
Frequently asked questions
Is a fake online profile used to ask for money a crime in Ethiopia?
Yes: Art. 10(1) of the Computer Crime Proclamation punishes fraudulently causing a person to act to his prejudice by misrepresenting his status, with rigorous imprisonment up to five years and a fine up to 50,000 Birr; Art. 701(1) of the Criminal Code also punishes collecting money by falsely claiming illness, injury or loss.
Can Ethiopia deal with a scammer who lives abroad?
Partly: the Attorney General may cooperate with foreign authorities including on extradition (Art. 42 of the Computer Crime Proclamation) and the Criminal Code applies to crimes committed abroad against an Ethiopian national if they are also offences where committed and serious enough to justify extradition (Art. 18(1)).
Where do I complain if money was taken through my bank account?
First to the bank or other financial service provider; after ten business days or an unsatisfactory reply, to the National Bank of Ethiopia under Directive FCP/01/2020.
Sources
- Computer Crime Proclamation No. 958/2016, Federal Negarit Gazette No. 83, 7 July 2016 (English and Amharic text) — Arts. 9 to 13, 20, 23, 40, 42, 45
- Criminal Code of the Federal Democratic Republic of Ethiopia, Proclamation No. 414/2004 (text as published; Equipo Nizkor copy) — Arts. 18, 581, 646, 649, 692, 696, 701
- Telecom Fraud Offence Proclamation No. 761/2012, Federal Negarit Gazette No. 61, 4 September 2012 — Arts. 5 and 10
- Ethiopian Nationality Proclamation No. 378/2003, Federal Negarit Gazette No. 13, 23 December 2003 — Art. 15: non-extradition of Ethiopian nationals
- National Bank of Ethiopia -- Financial Consumer Protection and Education (complaints under Directive No. FCP/01/2020) — complaints procedure under Directive FCP/01/2020; hotline 6230
- Information Network Security Administration (INSA) -- official website, "Report a cyber issue" link to Ethio-CERT — 'Report a cyber issue' link to Ethio-CERT; contact details
- Ethiopian Communications Authority -- consumer affairs page (complaints handling and dispute resolution) — telecom consumer complaints: ten working days, then thirty working days
The general article: Romance scams · Compare with another country