Somalia

In January 2026 the Authority announced that the Council of Ministers had approved regulations issued under article 41 elaborating the Act's provisions. Article 14 permits processing only on a lawful basis such as the data subject's consent, a contract, a legal obligation, an official function, or the data subject having intentionally made the data public, and article 15 requires purpose limitation, data minimisation, and accuracy.

Article 16 conditions a child's consent on a parent or legal representative, unless the child is sixteen or older and consenting to receive an online service at their own request, a threshold the Authority may lower to thirteen by regulation.

Articles 20 through 23 give a data subject the right to confirm, access, correct, and delete their personal data, to withdraw consent, to object to certain processing, and not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects.

Article 25 requires notifying the Authority of a personal data breach within seventy-two hours of becoming aware of it, and notifying each affected data subject without undue delay where the breach poses a high risk. Articles 30 and 31 condition a cross-border transfer on the recipient affording an adequate level of protection under a multi-factor test, or on a specific ground such as the data subject's informed consent.

Articles 32 through 34 require a data controller of major importance to register with the Authority and designate a data protection officer.

Article 37 lets the Authority order a remedy, compensation, or an administrative penalty of up to USD 1,000,000 or its Somali currency equivalent for a violation, article 38 makes failing to comply with such an order a separate offence carrying the same fine and up to two years' imprisonment, and article 40 lets an injured data subject recover damages through civil proceedings.