EthiopiaPersonal Data Protection Proclamation, sensitive personal data and minors
Proclamation No. 1321/2024, arts. 9-11 (sensitive personal data and minors)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 24 July 2024.
A sensitive categories rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Do not process sensitive personal data, including genetic or biometric data, unless a listed exception applies, such as the data subject's specific written consent.
- Process a minor's personal data only with the consent or authorization of a parent, guardian, or tutor, or where necessary to the minor's vitally important interest, and never for marketing, profiling, or merging of profiles.
- Do not process sensitive personal data in respect of race or ethnic origin unless the processing ensures justice and equality with regard to race or ethnic origin and is carried out with appropriate safeguards for the data subject's rights and freedoms.
- Where an exception does permit sensitive personal data to be processed, put appropriate technical and security safeguards in place first.
- Make reasonable efforts to verify the age of a data subject, and that consent was given or authorized by the minor's parent or guardian, taking available technology into account.
What it reaches
Obligation class
Prohibition, Consent, Biometric, Age verification
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 9(1) prohibits the processing of sensitive personal data outright, and article 9(2) permits it only in the listed cases: the data subject's written consent, specific to the purpose and given before the processing, unless a law bars the data subject from lifting the prohibition; protecting the life or health of the data subject or another person where the data subject cannot express consent; the lawful non-commercial objectives of public organizations; medical treatment carried out by a medical treatment institution; and the protection of lawful rights and interests in court or other public proceedings, or processing by a not-for-profit body with a political, philosophical, religious or trade union aim that relates solely to its members and is not disclosed outside it without consent.
Article 9(3) bars processing sensitive personal data in respect of race or ethnic origin unless it ensures justice and equality on those grounds and carries appropriate safeguards, and article 9(4) permits the listed cases only where appropriate technical and security safeguards are in place. Article 10 lets a Regulation add further categories of sensitive personal data.
Article 11 requires a minor's personal data to be processed in a manner that protects and advances the minor's rights and best interests, with the burden of proof on the data controller, and makes that processing lawful only where consent is given or authorized by the minor's parent, guardian or tutor, or where the processing is necessary to the minor's vitally important interest; the data controller must make reasonable efforts to verify the data subject's age and that the consent came from a parent or guardian, taking available technology into account, and processing a minor's personal data for marketing, profiling or merging of profiles is not allowed at all.
Article 70 enters the Proclamation into force on the date of its publication in the Negarit Gazeta, and it was signed at Addis Abeba on the 24th day of July 2024, so these provisions bind today.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometricsprocesses_voiceserves_minorshandles_health_records
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.