Digital Code, Book I: the Commission, administrative sanctions and criminal offences

Article 104 establishes the Commission Nationale de Protection des Données à Caractère Personnel as an independent administrative authority charged with overseeing compliance with Book I. Article 135 lets the Commission, where a controller does not comply with a formal notice, impose an injunction to bring processing into conformity or to satisfy a data subject's rights request, an injunction to stop processing or a withdrawal of authorisation, the locking of certain data, and an administrative sanction proportioned to the seriousness of the breach and the advantages drawn from it, capped at 70,000,000 Djiboutian francs or, for an enterprise, 5% of its worldwide turnover excluding tax for the last closed financial year, whichever is higher, on top of a daily penalty payment of up to 35,000,000 francs for continued non-compliance.

Chapter 6 (Articles 140 to 156) applies the Penal Code's general rules on attempt, complicity, receiving, and corporate liability to the offences it creates.

Article 141 punishes processing personal data without the prior formalities Chapter 2 of Title 3 requires, and Article 144 punishes processing that includes the national identification number outside an authorised case, each by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 Djiboutian francs, except Article 144's offence, which draws 5 years and a fixed fine of 4,000,000 francs.

Article 145 punishes unlawfully keeping sensitive personal data or offence-related data in computerised memory without the data subject's express consent, Article 146 punishes an unlawful health-research processing, Article 147 punishes fraudulent collection, Article 148 punishes misuse of purpose, and Article 149 punishes an unauthorised cross-border transfer, each by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 Djiboutian francs (Article 149's fine is a fixed 8,000,000 francs).

Article 150 punishes disregarding a data subject's objection by 6 months to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 francs, Article 151 punishes processing without the security measures Articles 11 to 13 require by 10 years' imprisonment and a fixed fine of 8,000,000 francs, Article 152 punishes failing to notify a personal-data breach by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 francs, and Article 153 punishes retaining personal data beyond its legal retention period by the same range.

Article 154 punishes an unauthorised disclosure of personal data by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 francs, falling to a fixed 5 years and 7,000,000 francs where the disclosure was merely negligent, and that prosecution runs only on the victim's own complaint.

Article 155 lets the criminal court order the erasure of the personal data at issue in an offence under this chapter, and Article 156 requires the public prosecutor to keep the Commission's president informed of the prosecutions this chapter's offences give rise to. The Digital Code, including Book I, was adopted by the National Assembly on 30 June 2025 and signed by the President of the Republic on 6 July 2025. It was published in the Journal Officiel on 18 September 2025, the date these provisions took effect.