Personal Data Protection Proclamation, rights of data subjects

Proclamation No. 1321/2024, arts. 24-32 (rights of data subjects)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 24 July 2024.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them.
Tell a data subject, when you obtain their personal data, who you are, the purposes and lawful basis of the processing, the recipients, any transfer to a third-party jurisdiction, the retention periods, their rights, and whether automated decision-making including profiling is in use; where the data came from elsewhere, add the categories obtained and their source, and give the information within a reasonable period and at the latest one month after obtaining it.
Answer a request for access at reasonable intervals, free of charge and without excessive delay, with confirmation of processing, the data in an intelligible form, their origin and the storage period, in electronic or hard copy at the data subject's preference, and put any refusal in writing with detailed reasons.
Correct inaccurate, incomplete, misleading or out-of-date personal data on request, free of charge and without excessive delay, and pass the correction on to every other data controller or third party the data were disclosed to in the year before the request.
Erase personal data on request, free of charge and without excessive delay, where it is no longer necessary for its purpose, where consent is withdrawn and no other ground applies, where the data subject objects and no overriding legitimate ground exists, or where it was processed unlawfully, and take reasonable steps to tell third parties processing data you made public.
Stop processing personal data for direct marketing, including the profiling related to it, as soon as the data subject objects, and bring the right to object to the data subject's attention explicitly.
Restrict processing on request in the cases article 30 lists, keep the data stored but otherwise unused without the data subject's consent, and tell the data subject before lifting the restriction.
Give a data subject their personal data in a structured, commonly used and machine-readable format on request, free of charge and without excessive delay, and transmit it directly to another controller or processor where that is technically possible.
Do not base an automated evaluation of personal aspects relating to an individual on sensitive personal data, and where an automated decision is permitted, put suitable measures in place to safeguard the data subject's rights, freedoms and legitimate interests.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 24 gives a data subject the right to be told the controller's and any representative's name and contact details, the data protection officer's contact details, the purposes and lawful basis of the processing, the recipients, any transfer to a third-party jurisdiction, the retention periods, the rights available including withdrawal of consent and complaint to the Authority, the existence of automated decision-making including profiling, and the categories of personal data processed; where the data were not obtained from the data subject the categories obtained and their source are added, and the information is due when the data are obtained, or otherwise within a reasonable period and at the latest within one month, or by the first communication or first disclosure if either comes sooner.

Article 25 gives a right of access, at reasonable intervals, free of charge and without excessive delay, to confirmation of processing, the data in an intelligible form, their origin, the storage period and the article 24 transparency information, in electronic or hard copy at the data subject's preference, and article 26 lists the narrow grounds on which access may be refused, each refusal to be given in writing with detailed reasons.

Article 27 gives a right to rectification and requires the controller to pass a correction on to anyone the data were disclosed to in the year before the request, article 28 gives a right to erasure on the listed grounds, article 29 gives a right to object, including an unqualified stop to direct marketing and the profiling related to it, article 30 gives a right to restriction of processing, and article 32 gives a right to data portability in a structured, commonly used and machine-readable format, free of charge and without excessive delay.

Article 31 gives every data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them, to obtain human intervention and to express their views, and bars any automated evaluation of personal aspects from being based on sensitive personal data.

Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

Personal Data Protection Proclamation No. 1321/2024, full English text (MetaAppz Ethiopian Federal Laws reference)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app