Ethiopia's data protection law turns one with no implementing directives in force

A year after Ethiopia enacted the Personal Data Protection Proclamation No. 1321/2024, the Ethiopian Communications Authority had issued none of the four implementing directives the law needs, per Shega's November 2025 investigation. The statute's penalties are severe on paper: up to 4% of worldwide turnover for violations involving minors or sensitive data, and 5 to 10 years' imprisonment for unauthorised cross-border transfers. Until the directives and the registration portal arrive, Ethiopia has a data protection law without data protection enforcement.