Soo galCodso gelitaan

← Dhammaan warbixinnada

Data centres and data protection: what Somalia's law requires

Bulshadaa isu keentay · DIGITAL · 11 min read · 2026-09-30

Waxaa isu keenay wax-ku-biiriyayaal bulsho iyagoo ka duulaya ilo dadweyne. Tirooyinku waxay noqon karaan qiyaaso — si madax-bannaan u xaqiiji ka hor inta aadan ku tiirsan.

Tusmada
  1. Summary
  2. Where Xidig members may contribute
  3. Possible services, research, supplier or collaboration roles
  4. Who may find this useful
  5. What the law requires
  6. Dependencies and implementation constraints
  7. Risks and unknowns
  8. Questions members should verify before acting
  9. What is confirmed, and what isn't
  10. Relevant next steps
  11. More about the source
  12. Related reports
  13. About this report
  14. Sources

Organisations that hold personal data in Somalia now have duties under the 2023 Data Protection Act. What the law requires, what the regulator has done, where data centres stand, and where members can help.

Not legal or investment advice. Independent summary of public sources. The Government of Somalia has not endorsed it. The Data Protection Authority's website links a scanned copy of the Act that Xidig could not read; the unofficial English text used here shows the penalty figures in square brackets. Check the official text and take legal advice before acting.

Summary

Organisations in Somalia that hold personal data now have registration and compliance duties under the country's data protection law, and the regulator has begun pressing them to register. In May 2026 it named telecoms, banking, fintech, hospitals, NGOs and government agencies among the sectors concerned. This creates practical openings in data-protection compliance, security and training for Somali organisations.

What Xidig found:

  • The Act: the Data Protection Act, Law No. 005 of 2023, has been in force since 23 March 2023, according to legal analyses. The DPA's website links a scanned copy of the Act, which Xidig could not read.
  • Rights and duties: it gives people rights to access, correct and delete their data; lists sensitive data including clan; requires data controllers to report breaches likely to put people's rights at risk to the Authority within 72 hours; and allows transfers abroad only with adequate protection.
  • The regulator: a Data Protection Authority (DPA) is running. The cabinet approved implementing regulations in January 2026; Xidig could not find their text online.
  • Registration: the DPA's January 2026 guidelines set registration fees of US$350, US$1,050 or US$2,500 by organisation size; government bodies pay no fee. In June 2026 the DPA directed all data controllers and processors to register. Xidig found no published fines or enforcement decisions.
  • Penalties are uncertain: the unofficial English text of the Act that Xidig used shows administrative penalties of up to US$1 million, and a fine and two years' imprisonment for ignoring the Authority's orders, but all these figures appear in square brackets, as if not finalised. Xidig could not confirm them in the official text.
  • Data centres: construction of a government data centre in Mogadishu began in 2023. In August 2026 a minister again described a national data centre as being planned. Its current status is unclear.

The government has also listed a US$65M e-government proposal, at pre-feasibility stage, that includes national data centres; details are under More about the source.

Where Xidig members may contribute

  • Compliance support: data protection officers, lawyers and consultants helping Somali organisations register and comply.
  • Security: information-security and data-centre operations expertise.
  • Training: awareness courses for staff in banks, hospitals, NGOs and schools.
  • Translation: clear Somali and English guidance on people's rights.

Possible services, research, supplier or collaboration roles

  • Registration and compliance services, delivered by qualified professionals.
  • Data-protection training for sectors the DPA has named.
  • Research on how organisations are adapting, and on data-centre capacity in Somalia.

Who may find this useful

  • Businesses, NGOs, schools and hospitals that hold personal data.
  • IT and security professionals.
  • Lawyers and compliance officers.
  • Anyone who wants to know their data rights.

What the law requires

The Act.

  • Name and number: Law No. 005 of 2023, the Data Protection Act (the DPA cites it as "Data Protection Act No. 005 (2023)").
  • In force: from 23 March 2023, according to legal analyses by Strathmore University's CIPIT and others.
  • Purpose: among its objectives (Art. 3), to "protect data subjects from risks…arising from the processing of their personal data" and to "establish an authority designated for the protection and oversight of public and personal data".
  • Exemptions: according to CIPIT, the Act does not apply to purely personal or household use, and exempts some criminal investigations, national security, health emergencies and journalistic, educational, artistic or literary expression.

Key obligations (unofficial English text of the Act, as published by DataGuidance, and legal analyses; article numbers follow that text):

TopicWhat the Act says
Lawful processingPersonal data may be processed on grounds including consent, contract, legal obligation, vital interests, public interest and legitimate interests
Sensitive dataIncludes "biometric data; race, clan or ethnic origin; religious beliefs; health status; marital status or sex life; political opinions or affiliations"
People's rightsAccess, correction, deletion, withdrawing consent, objecting, and not being subject to decisions made solely by automated processing
RegistrationIn the Act, a "data controller of major importance" must register within six months of qualifying (Art. 32). The DPA's 2026 guidelines and directive apply registration to all data controllers and processors
Data protection officerRequired for data controllers of major importance (Art. 34)
BreachesReport to the Authority "within seventy-two hours after having become aware of" a breach "likely to result in a risk to the rights and freedoms of individuals", and tell affected people "without undue delay" where risk is high (Art. 25)
Transfers abroadAllowed where the destination offers "an adequate level of protection", or under safeguards or specific exceptions (Art. 30). Xidig found no rule requiring data to be stored in Somalia
PenaltiesThe Authority may order an administrative penalty "of up to [US one million dollars]" (Art. 37). Failing to comply with its orders is an offence carrying "a fine of [US one million dollars] … and imprisonment for [two] years" (Art. 38). The square brackets are in the English text; Xidig could not confirm the figures in the official text

The Authority.

  • Status: the DPA describes itself as an independent regulator under Law No. 005, set up to "oversee the protection of personal data, ensure privacy, and enforce compliance among organizations that process personal information".
  • Services: registration and licensing, complaints and investigations, breach notification, guidance and training.
  • Regulations: on 5 January 2026 the DPA announced that the Council of Ministers had "officially approved the Regulations" under the Act. Xidig could not find the regulations' text online. Techhive Advisory reported in June 2024 that the DPA had published an "Implementation Regulation" that February; it is unclear whether the 2026 regulations replace it.

Registration in practice. The DPA's Registration Guidelines (version 1.0, January 2026) cover data controllers, data processors and data protection officers:

CategoryStaffRevenueFee
Small1–50Up to US$40,000US$350
Medium51–99US$40,001–386,996.90US$1,050
LargeMore than 99Above US$386,996.90US$2,500
GovernmentAnyAnyNo fee (exempt)
  • Government institutions pay no fee but are still covered by registration.
  • Process: approval "within 30 days of complete submission"; changes must be notified "within 14 days of any material change".
  • Non-compliance: the guidelines list "Administrative fines", "Enforcement notices" and "Suspension of processing activities".
  • Enforcement drive: in June 2026 the DPA directed "all data controllers and data processors operating in Somalia to comply with mandatory registration requirements" (TechAfrica News). In May 2026 it said it was introducing monitoring and named telecoms, banking, fintech, hospitals, NGOs and government agencies among the sectors concerned (Dawan).
  • Enforcement record: Xidig found no published fines or enforcement decisions.

Related laws.

  • Cybersecurity: the House of the People approved a Cybersecurity Bill on 26 January 2026, setting up a national framework and incident response (SONNA). The communications regulator's website describes a national cybersecurity law as enacted in 2025. But on 29 August 2026 the Senate held its first reading of the bill (Dawan), so it was not yet law at that date.
  • Cybercrime: the cabinet approved a Cybercrime Bill in August 2025. Its parliamentary status is unknown.
  • Digital ID: the national identification authority cites the 2023 identification law and an operational data protection regulation, and says data is collected "only with explicit and informed consent".
  • Regional treaty: Somalia has not signed or ratified the African Union's Convention on Cyber Security and Personal Data Protection (AU status list, February 2026).

Data centres.

  • 2023: on 15 November 2023 the communications minister began construction of a national data centre in Mogadishu, to host government services and data (NCA).
  • 2024: in April 2024 the minister toured the centre, still under construction; it would "centralize all data related to various government bodies" (Ministry of Communications and Technology).
  • 2025 strategy: the ministry's eGovernment Strategy 2025–2029 describes "A proposed Somalia National Data Center (SNDC)".
  • 2026: in August 2026 a state minister said a national data centre was "currently being planned" (Dawan).
  • Commercial facilities: Xidig found no independently certified (Tier-rated) data centre in Somalia (Uptime Institute public list, checked September 2026).
  • What this means: it is unclear whether the government's proposed data centres, the 2023 facility and the 2026 plan are the same project.

Dependencies and implementation constraints

  • Published texts: a readable official text of the Act, and the regulations, need to be publicly available.
  • Regulator capacity to process registrations and handle complaints.
  • Reliable power and connectivity for data centres. See Fibre backbones and infrastructure sharing.

Risks and unknowns

  • Uncertain penalties until the official text is confirmed.
  • Uneven compliance in a large informal economy.
  • Security incidents in new government systems holding ID and service data.
  • Unclear data-centre status, which may lead to duplication.

Questions members should verify before acting

  1. What does the official text of the Act say on penalties and registration thresholds?
  2. What do the January 2026 regulations require, and is there a registration deadline?
  3. Which registration category and fee applies to your organisation under the DPA's guidelines, and does the Act treat you as a "data controller of major importance"?
  4. What is the status of the national data centre, and who runs it?

What is confirmed, and what isn't

Confirmed

  • The Act's number, and the DPA's existence and services.
  • Entry into force on 23 March 2023, as reported by CIPIT and Techhive Advisory.
  • Cabinet approval of the regulations (January 2026) and the registration guidelines and fees.
  • The June 2026 registration directive.
  • Construction of a government data centre from 2023.
  • Somalia's non-ratification of the AU convention.

Our interpretation

  • Compliance and security skills will be in demand as registration is enforced.

Not yet verified

  • The penalty amounts in the official text of the Act (the DPA's copy is a scan that Xidig could not read).
  • The regulations' text and any deadline.
  • Final enactment of the cybersecurity law.
  • The data centre's current status.

Relevant next steps

  • The DPA's registration guidelines are the published reference for organisations holding personal data.
  • Follow the DPA (dpa.gov.so) for regulations and guidance.

More about the source

The government's investment booklet, Bankable Projects 2026–2030 (MoPIED / SOMINVEST), is one of the sources for this report. The details it gives are summarised here as printed.

Digitalising Somalia: E-Government Services & Data Center Infrastructure (TC-02, pp.66–67).

  • What: "Development of Somalia's first e-government services and establishment of state-of-the-art national data centers."

  • Aims: to "enhance the delivery of 84 essential government services, modernize public administration, ensure security of private data, and attract investment".

  • Drivers: "Enhance efficiency and transparency of government services", "Strengthen data sovereignty and security" and "Support digital transformation".

  • Estimates as printed: US$65M; 4 years.

  • Promoters: SOMINVEST and the Ministry of Communications and Technology.

  • Primary source: MoPIED / SOMINVEST, Bankable Projects 2026–2030, posted 19 Nov 2025. E-government fact sheet at PDF pp.66–67.

About this report

By Xidig members and collaborators.

Project codes. Codes such as EN-04 or AG-05 are Xidig's own shorthand for the booklet's fact sheets, by sector; the booklet itself does not number its projects.

How we researched it. We read the full 97-page booklet and checked every figure, page reference and quotation used here against it. We then compared the booklet's claims with the official, international, academic and news sources listed below, and we say where they differ. We did not interview anyone for this report.

Corrections. If you spot an error, please tell us using the correction link on this page.

Sources

Primary

Supporting

Source notes

  • The English text of the Act was published by a commercial legal database, not by the government. Figures shown in brackets in that text may differ from the enacted law. The DPA's own copy of the Act is a scan that Xidig could not read.