Digital Rights at a glance
Somalia’s digital rights landscape is advancing unevenly: a strong data protection law and growing cybersecurity legislation sit alongside weak enforcement, a still-unratified Malabo Convention, and persistent gaps in privacy and platform accountability.
Key commitments
Malabo Convention 🔴
Somalia has neither signed nor ratified the Malabo Convention. Somali civil society is currently campaigning for accession to the Convention (civil society advocacy consultation meeting, Mogadishu, 20 July 2026).
Budapest Convention 🔴
Somalia is not a party of the Budapest Convention.
Data protection law
The Data Protection Act, 2023 (Law No. 005) was signed by President Hassan Sheikh Mohamud on 21 March 2023 and in effect since 23 March 2023.
Existence of a Data Protection Authority 🟠
The 2023 Data Protection Act established the Somalia Data Protection Authority as the oversight body. The institution is still in the process of establishing its regulations and building capacity.
Cybercrime law
Somalia Cybercrime Bill, was approved by the Council of Ministers in August 2025, it still needs to pass the Parliament stage. The cybercrime law is presented by the government as a measure to protect the confidentiality, safety and security of Somalia’s digital systems and national interests.
The Cybersecurity Law was approved by the House of People (lower chamber of the Parliament) in January 2026 and needs to pass the stages of the Upper House approval and President’s signature. It establishes a national framework for managing cybersecurity by defining the responsibilities of the Ministry of Communications, the technical role of the National Communications Authority of Somalia, the obligations of critical infrastructure operators, and the system for preventing, reporting, and responding to cybersecurity incidents.
State of play
Somalia has taken real steps on data protection, but implementation is still catching up to the law. The Data Protection Act (2023) created core rights for individuals over their personal data and established a national Data Protection Authority, though enforcement remains limited in practice. That gap was exposed in late 2025, when a breach of a government digital platform compromised tens of thousands of records, and it continues to shape public concern over how the country’s new national ID system handles personal data. Somalia also remains outside the Malabo Convention altogether, even as local civil society is actively pushing government institutions to sign and ratify it. A national Cybersecurity Law has cleared the lower house of parliament, a meaningful step forward, though it has not yet completed the full legislative process. This sits alongside a separate Cybercrime Bill — approved by Cabinet in 2025 but not yet before Parliament — which would criminalise specific offenses like hacking and data theft, distinct from the governance-focused cybersecurity law.
Recommendations
1. Sign and ratify the Malabo Convention, bringing Somalia’s existing data protection and emerging cybersecurity legislation in line with continental standards.
2. Assign resources to the Data Protection Authority to have it running with funding, trained staff, and clear public guidance so that individuals can claim their rights under the law and report breaches.
3. Complete the cybersecurity law’s remaining legislative steps and advance the still-pending Cybercrime Bill to Parliament, pairing both with transparent rules on how government digital systems collect and protect citizens’ personal data.
Partners of Digitalise Youth who contributed to this section:
Media Ink
Digital Shelter
