LexLint

Know the law your code answers to.

Law / Somalia

Data Protection Act, 2023, sensitive personal data and children's consent

Data Protection Act, Law No. 005 of 2023, arts. 2(15), 14(5) and 16 (sensitive personal data and children)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

  • Treat biometric data, race, clan or ethnic origin, religious belief, health status, marital status or sex life, and political opinion or affiliation as sensitive personal data, and apply the measures the Data Protection Authority prescribes by regulation for processing it.
  • Obtain consent from a parent or other appropriate legal representative before processing the personal data of a child or of an individual otherwise lacking legal capacity, unless the child is sixteen or older and is asking for an electronic service themselves.
  • Apply appropriate processes to verify the identity and age of a data subject and of a representative giving consent for them.

What it reaches

Obligation class

Consent, Biometric

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 2(15) defines sensitive personal data as personal data relating to an individual's biometric data, race, clan or ethnic origin, religious beliefs, health status, marital status or sex life, or political opinions or affiliations, together with any further category the Authority prescribes by regulation.

Article 14(5) empowers the Authority to prescribe in regulations the measures that must be applied to the processing of sensitive personal data, having regard to the risk of significant harm, the expectation of confidentiality and the protection afforded to personal data generally, so the heightened measures themselves are set by regulation rather than by the Act.

Article 16 requires consent for a child or an individual otherwise lacking legal capacity to be obtained from a parent or other appropriate legal representative, permits a data controller to rely on the consent of a child aged sixteen or more for information and services supplied by electronic means at that child's own request, lets the Authority extend that to a child aged thirteen or more by regulation, and requires a controller to verify the identity and age of the data subject and the representative.

The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin, and no publication date has been located, so the day it took effect is not stated here. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.

When LexLint raises it

  • processes_biometrics
  • processes_voice
  • crawls_web
  • trains_models

Read the law

Text of the Data Protection Act, Law No. 005 of 2023, reproduced by DataGuidance
the Data Protection Authority names the Act and its own copy of the text is not available

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app