Somalia passed a Data Protection Act in March 2023. It is not a draft, it is not a policy paper, and it is not waiting on anything to come into force — it took effect two days after it was signed. Three years on, a great many organisations holding Somali personal data are operating exactly as they did before it existed, largely because nobody has told them what changed.
This is a plain-language account of what the Act established and where it creates practical work. It is written by an infrastructure operator, not a law firm — take the legal reading from a lawyer. What we can speak to with authority is the part that ends up being an engineering problem.
What the Act did
Law No. 005 of 2023 was signed by the President on 21 March 2023 and came into effect on 23 March 2023. It establishes data protection principles familiar from comparable regimes elsewhere: lawful processing, minimisation of what is collected, and an obligation to adopt security safeguards over personal data.
Article 6 establishes the Somalia Data Protection Authority as the supervisory body, with a mandate over personal data within Somalia’s territory. There is now a named regulator with a remit, which is the change that matters most in practice — principles without a supervisory authority tend to stay theoretical.
Commentators have raised reasonable questions about the Authority’s independence and about terms the Act leaves undefined. Those are real issues and they are being debated. They are also not a reason to wait: an imperfectly specified obligation is still an obligation, and the organisations that get caught out by new regimes are rarely the ones that engaged early.
Where the practical pressure falls
In our experience the Act surfaces in four places, and only the first is really about law.
1. Knowing where the data is
A surprising number of institutions cannot answer this precisely. “In the cloud” is not an answer to a supervisory authority, and neither is the name of a platform — platforms operate in many regions and the one your account defaults to is often not the one you would have chosen. The first task is almost always an inventory: what personal data exists, which systems hold it, and in which country those systems physically sit.
2. Security safeguards you can evidence
An obligation to adopt safeguards is an obligation you can be asked to demonstrate. A server in an office, behind an unmetered power supply, with physical access controlled by whoever has the key, is difficult to describe as a safeguard in writing — even when nothing has ever gone wrong with it. Much of what we are asked for is not exotic security; it is the ability to document access control, power resilience and environmental conditions.
3. The transfer question
Where personal data leaves the country, the sensible posture is to know that it does, to know why, and to be able to justify it. Organisations that have never examined this often discover the answer is “because the default region of a service we signed up to in 2019 was in another continent” — which is not a justification so much as an accident.
4. Being asked, and having an answer ready
The expensive version of compliance is the retrospective one: assembling an account of your data estate during an enquiry, under time pressure, from people who have other jobs. The cheap version is having written it down once, in advance, and keeping it current.
What changed on the infrastructure side
For most of the period since independence, a Somali institution that wanted to keep records in the country had one realistic option: its own equipment, in its own building, maintained by whoever was available. The alternative was a data centre on another continent — better on resilience, worse on jurisdiction, and increasingly awkward to explain.
That trade-off has closed. Carrier-neutral data centre capacity now exists in Mogadishu with the power and cooling topology you would expect of a proper facility, cross-connected to international capacity in the same building. The relevant point for this discussion is not whose facility it is. It is that “in Somalia” and “in a serious facility” stopped being mutually exclusive, which means the residency conversation is now an engineering decision with a defensible answer rather than a compromise that has to be argued away.
Four questions worth settling this quarter
- What personal data do we hold, and where does it physically sit? Country, city, facility, operator.
- Which of it leaves Somalia, and why? If the answer is “because that is how the system was set up”, that is worth revisiting.
- Could we evidence our safeguards? Not describe them — evidence them, with documentation somebody else would accept.
- Who owns this internally? Regimes like this fail on ownership more than on technology.
None of those four require a purchase. They require an afternoon and somebody senior enough to get straight answers. What they usually produce is a short list of things that were never deliberate decisions — and those are generally the cheapest problems you will ever fix.
Sources: Somalia Data Protection Act, Law No. 005 of 2023 (in force 23 March 2023); Somalia Data Protection Authority; CIPIT, Strathmore University — analysis of the Act. This article describes the framework in general terms and is not legal advice; obtain your own on the specifics.
