Data Protection Law, Law No. 5 (2023)
Federal
Sharciga Dhowrista Xogta Dadweynaha, Sharci Lr. 5 (2023)
Chapter 1 — General Provisions (Articles 1–5)
Names and defines the Law, states its objectives and territorial and material scope, and identifies limited exclusions. It protects personal data while permitting lawful use, supports secure digital services and applies to relevant processing connected with persons in Somalia.
Cutubka 1aad — Qodobbo Guud (Qodobbada 1–5)
Wuxuu magacaabayaa oo qeexayaa Sharciga, sheegaya ujeeddooyinkiisa iyo baaxaddiisa dhuleed iyo maaddadeed, wuxuuna tilmaamayaa reebitaanno xaddidan. Wuxuu ilaalinayaa xogta shakhsiga ah isagoo oggolaanaya adeegsi sharci ah, taageeraya adeegyo dijitaal oo ammaan ah, kuna dabaqmaya farsamaynta xogta ee la xiriirta dadka Soomaaliya jooga.
Chapter 2 — Data Protection Authority (Articles 6–13)
Establishes an independent Data Protection Authority with legal personality and sets its duties, investigative and regulatory powers, funding and reporting. It governs the management board, members, Director-General, staff, removal from office and conflicts of interest.
Cutubka 2aad — Hay'adda Dhowrista Xogta (Qodobbada 6–13)
Wuxuu dhisayaa Hay'ad Dhowrista Xogta oo madax-bannaan, lehna shakhsiyad qaanuuni ah, wuxuuna dejinayaa waajibaadkeeda, awoodaha baarista iyo nidaaminta, maalgelinta iyo warbixinta. Wuxuu nidaaminayaa guddiga maamulka, xubnaha, Maareeyaha Guud, shaqaalaha, xil-ka-qaadista iyo danaha is-diidan.
Chapter 3 — Principles for Processing Personal Data (Articles 14–19)
Requires a lawful basis for processing and regulates consent, purpose limitation, data minimisation, accuracy and retention. It adds safeguards for children and persons lacking legal capacity, requires clear information for data subjects and makes controllers responsible for compliance.
Cutubka 3aad — Mabaadi'da Adeegsiga Xogta Shakhsiga ah (Qodobbada 14–19)
Wuxuu waajibinayaa saldhig sharci ah oo xogta loo adeegsado, wuxuuna nidaaminayaa oggolaanshaha, xaddididda ujeeddada, yaraynta xogta, saxnaanta iyo muddada kaydinta. Wuxuu ilaalin dheeraad ah siinayaa carruurta iyo dadka aan lahayn awood sharci, wuxuuna farayaa in qofka xogta leh la siiyo macluumaad cad, xog-dhowrahana lagula xisaabtamo u-hoggaansanaanta.
Chapter 4 — Rights of Data Subjects (Articles 20–23)
Gives individuals rights to confirmation and access, correction and deletion, withdrawal of consent and objection to processing, together with protection from decisions based solely on automated processing.
Cutubka 4aad — Xuquuqda Qofka Xogta Leh (Qodobbada 20–23)
Wuxuu qofka siinayaa xaqa xaqiijinta iyo helitaanka xogtiisa, saxidda iyo tirtiridda, ka-noqoshada oggolaanshaha iyo diidmada adeegsiga xogta, iyo ilaalin ka dhan ah go'aanno ku salaysan keliya farsamayn otomaatig ah.
Chapter 5 — Data Security and Impact Assessment (Articles 24–29)
Requires appropriate technical and organisational security, confidentiality and integrity measures. It sets breach-notification content and timing, breach records and Authority guidance, and requires impact assessments for processing likely to create a high risk to rights and freedoms.
Cutubka 5aad — Amniga Xogta iyo Qiimaynta Saamaynta (Qodobbada 24–29)
Wuxuu waajibinayaa tallaabooyin farsamo iyo maamul oo ku habboon amniga, sirta iyo hufnaanta xogta. Wuxuu dejinayaa nuxurka iyo waqtiga ogeysiiska jabsashada xogta, diiwaanka dhacdooyinka iyo hagidda Hay'adda, wuxuuna farayaa qiimaynta saamaynta marka adeegsiga xogtu halis sare ku keeni karo xuquuqda iyo xorriyadaha.
Chapter 6 — Cross-border Transfers (Articles 30–31)
Restricts transfer of personal data outside Somalia or to international organisations unless adequate protection, approved safeguards or a stated lawful exception applies, with notification and accountability requirements.
Cutubka 6aad — Gudbinta Xogta ee Xuduudaha Ka Gudubta (Qodobbada 30–31)
Wuxuu xaddidayaa in xogta shakhsiga ah loo gudbiyo dal ka baxsan Soomaaliya ama hay'ad caalami ah ilaa ay jirto ilaalin ku filan, dammaanad la ansixiyey ama reebitaan sharci ah, isagoo waajibinaya ogeysiin iyo isla-xisaabtan.
Chapter 7 — Registration and Fees (Articles 32–34)
Requires significant data controllers to register with the Authority, permits proportionate fees and levies and provides for appointment of data-protection officers and their compliance role.
Cutubka 7aad — Diiwaangelinta iyo Khidmadaha (Qodobbada 32–34)
Wuxuu xog-dhowrayaasha muhiimka ah ku waajibinayaa inay iska diiwaangeliyaan Hay'adda, wuxuu oggolaanayaa khidmad iyo canshuur u dhiganta hawsha, wuxuuna dejinayaa magacaabista saraakiisha dhowrista xogta iyo doorkooda u-hoggaansanaanta.
Chapter 8 — Enforcement and Remedies (Articles 35–40)
Creates complaint and investigation procedures, empowers the Authority to issue enforceable orders and sanctions non-compliance. It provides an appeal route and permits civil compensation for harm, distress or loss caused by unlawful processing.
Cutubka 8aad — Fulinta iyo Xalalka (Qodobbada 35–40)
Wuxuu dejinayaa habraaca cabashada iyo baarista, wuxuuna Hay'adda awood u siinayaa amarro la fulin karo, isagoo ciqaabaya u-hoggaansanaan la'aanta. Wuxuu bixiyaa waddo rafcaan iyo magdhow madani ah oo lagu dalban karo waxyeello, dhib ama khasaaro ka dhashay adeegsi xog oo sharci-darro ah.
Chapter 9 — Miscellaneous and Final Provisions (Articles 41–43)
Authorises implementing regulations, repeals inconsistent provisions and sets the Law's commencement following enactment and official publication.
Cutubka 9aad — Qodobbo Qubane iyo Kama-dambays ah (Qodobbada 41–43)
Wuxuu oggolaanayaa xeer-hoosaadyo fulineed, burinayaa qodobbada ka hor imanaya, wuxuuna dejinayaa dhaqan-galka Sharciga marka la ansixiyo laguna soo saaro Faafinta Rasmiga ah.