Ethiopia Personal Data Protection Proclamation 1321/2024
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | ET PDPP |
| Region | Middle East & Africa |
| Country or scope | Ethiopia |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers ET PDPP
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ET-PDPP-SEC Security of Processing | Controllers and processors must implement appropriate technical and organizational security measures, including encryption, to protect personal data, which presumes verifiable integrity of the software components that process it (Proclamation No. 1321/2024, security-measures obligation) | Scan |
ET-PDPP-ROPA Records of Processing Activities | Controllers and processors must maintain detailed records of processing operations for transparency and accountability, which requires an enumerated inventory of the software systems and components involved (Proclamation No. 1321/2024, records-of-processing obligation) | Scan |
ET-PDPP-BREACH Breach Notification Readiness | Data breaches must be notified to the Ethiopian Communications Authority within 72 hours; assessing scope and impact that quickly requires precisely identifiable components (PURL/CPE) in the processing stack (Proclamation No. 1321/2024, breach-notification obligation) | Scan |
ET-PDPP-PROC Processor and Third-Party Obligations | Processing on behalf of a controller must be governed by binding obligations and adequate guarantees, requiring the third-party suppliers of processing software to be identified and accountable (Proclamation No. 1321/2024, controller-processor obligations) | Scan |
ET-PDPP-DPIA Impact Assessment for High-Risk Processing | A data protection impact assessment is required for high-risk processing, which presupposes that the processing system is named and its constituent components are known (Proclamation No. 1321/2024, DPIA obligation) | Scan |
ET-PDPP-DOC Accountable, Dated Documentation | Accountability to the supervisory authority requires dated, identifiable documentation of processing systems, satisfied by an SBOM with a document identifier and creation timestamp (Proclamation No. 1321/2024, accountability principle) | Scan |
Policy templates
All 22 from the standard set, adapted to ET PDPP.
Eswatini Data Protection Act 2022
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
Gabon Law No. 001/2011 on Protection of Personal Data
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.