CevroEthiopia: Personal Data Protection Proclamation No. 1321/2024 and what it requires
Personal Data Protection Proclamation No. 1321/2024: a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by Ethiopian Communications Authority (ECA).
Key requirements at a glance
| Registration with the regulator | Required |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | Within 72 hours |
| Cross-border transfer restrictions | Required |
| Data localization | Depends on thresholds or circumstances |
Penalties and enforcement
Administrative penalties provided for under the Proclamation; enforcement practice is still emerging.
What to know in practice
A recent, comprehensive law with DPIA and data-subject-rights provisions, plus some data-localization elements.
How Cevro helps
- Maps Personal Data Protection Proclamation No. 1321/2024 to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Ethiopia?
Ethiopian Communications Authority (ECA) oversees Personal Data Protection Proclamation No. 1321/2024.
Is breach notification mandatory under Personal Data Protection Proclamation No. 1321/2024?
The law sets a 72-hour window for notifying the regulator of a personal data breach, so you need detection and an incident process that can meet it.
Does Ethiopia restrict cross-border data transfers?
Yes. Moving personal data out of Ethiopia is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Personal Data Protection Proclamation No. 1321/2024?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in Ethiopia?
Administrative penalties provided for under the Proclamation; enforcement practice is still emerging.