Data Protection Act, 2023, cross-border transfers of personal data

Data Protection Act, Law No. 005 of 2023, arts. 30-31 (cross-border transfers)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before transferring personal data outside Somalia or to an international organisation, confirm the recipient country, organisation or mechanism affords an adequate level of protection, or rely on a ground the Act lists.
Where you transfer without adequate protection on the data subject's consent, inform them of the risks of the transfer first, and stop if they withdraw consent.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 30(1) prohibits a data controller from transferring personal data to a country outside the Federal Republic of Somalia or to an international organisation unless the data will be received only where an adequate level of protection applies, the recipient is an international organisation whose policies and measures afford an adequate level of protection, the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct, certification mechanism or other measure affording an adequate level of protection, or a legal basis in article 31 applies.

Article 30(2) lists the factors adequacy is assessed against. Article 31 permits a transfer without adequate protection where the data subject has given and not withdrawn consent after being informed of the risks, the transfer is necessary for a contract with or in the interest of the data subject, or another listed ground applies.

The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin, and no publication date has been located, so the day it took effect is not stated here. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

Text of the Data Protection Act, Law No. 005 of 2023, reproduced by DataGuidance
the Data Protection Authority names the Act and its own copy of the text is not available

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app