SomaliaData Protection Act, 2023, complaints, orders of the Authority and civil remedies
Data Protection Act, Law No. 005 of 2023, arts. 35-40 (complaints, orders and civil remedies)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Expect the Data Protection Authority to investigate a complaint that your processing violates the Act, and to be able to order you to stop, to remedy the violation, to compensate the data subject, to account for profits, or to pay an administrative penalty of up to one million United States dollars.
- Comply with an order of the Authority, or apply to the Supreme Court for judicial review within thirty days: failing to comply is an offence carrying the same fine and up to two years' imprisonment.
- Compensate a data subject who suffers injury, loss or harm from your violation of the Act, which they or a consumer organisation acting for them may recover by civil proceedings.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Failing to comply with an order the Authority makes under article 37 is an offence carrying a fine of up to USD 1,000,000, or its Somali currency equivalent, and imprisonment of up to two years (art. 38(1)).
Penalty structure
Administrative penalty the Authority may order against a data controller for a violation of the Act (art. 37(1)(f)); failing to comply with such an order is a separate offence under article 38 carrying the same fine plus up to two years' imprisonment.
- Rule
- Fixed only
- As of
- 19 September 2026
- Currency
- USD
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
Data Protection Authority
What it reaches
Obligation class
Reporting, Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 35 lets a data subject aggrieved by an act or omission that violates the Act lodge a complaint with the Authority, which admits a complaint where the complainant has an interest and the complaint is not frivolous or vexatious. Article 36 lets the Authority investigate on a complaint or of its own accord and compel attendance, documents and information.
Article 37 lets the Authority order a data controller to stop the violating processing, remedy the violation, pay compensation to a data subject who suffered injury, loss or harm, account for profits, or pay an administrative penalty of up to one million United States dollars or its equivalent in Somali currency.
Article 38 makes failing to comply with such an order an offence carrying the same fine and imprisonment for two years, and article 39 allows an application to the Supreme Court within thirty days for judicial review of an order. Article 40 lets a data subject who suffers injury, loss or harm, or a consumer organisation acting for them, recover damages by civil proceedings.
The Act comes into force on adoption by the Federal Parliament, promulgation by the President and publication in the Official Bulletin, and no publication date has been located, so the day it took effect is not stated here. The Act is operative: in January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotprocesses_biometrics
Read the law
Text of the Data Protection Act, Law No. 005 of 2023, reproduced by DataGuidance
the Data Protection Authority names the Act and its own copy of the text is not available
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.