Ethiopia's data protection law turns one with no implementing directives in force

A year after Ethiopia enacted the Personal Data Protection Proclamation No. 1321/2024, the Ethiopian Communications Authority had issued none of the four implementing directives the law requires, according to Shega's November 2025 investigation.

The statute's penalties are severe on paper: up to 4% of worldwide turnover for violations involving minors or sensitive data, and 5 to 10 years' imprisonment for unauthorised cross-border transfers. Without the directives and the registration portal, however, the law has no functioning enforcement mechanism.