Djibouti

Digital Code (approved by the National Assembly 30 June 2025), personal-data regime of 156 articles IN FORCE

commenced adopted 2025-06-30; promulgated 2025-07-06; published JO 2025-09-18 · Official full text ↗

Scope

Automated processing and structured-filing-system manual processing; extraterritorial reach over foreign controllers/processors offering goods/services to or monitoring individuals in Djibouti; exclusions for personal/household processing and transient technical copies; a local representative can be required of foreign entities.

Key obligations

Tiered prior formalities with the CNDP: simple declarations for routine processing, simplified declarations for common low-risk types, and prior authorisation for sensitive-data research, genetic data, identification biometrics, offence data, exclusion-effect processing, interconnections and national-ID processing (DPO appointment exempts, except international transfers); Mandatory DPO for public authorities, large-scale systematic monitoring, and large-scale sensitive/conviction data; 72-hour breach notification to the CNDP plus high-risk communication to data subjects; Post-mortem privacy directives and heirs' rights; a specific CNDP-authorised regime for health research data; a public national register of declared/authorised processing

DPO required

Yes, in defined cases: public authorities, large-scale systematic monitoring, or large-scale processing of sensitive or conviction data; the DPO acts independently and cooperates with the CNDP.

Registration

Yes: the declaration/authorisation tiers above, recorded in the CNDP's public national register; state processing follows decree/order pathways.

Cross-border transfers

Transfers only to destinations with an equivalent and sufficient level of protection, onward transfers included (art. 99); the CNDP assesses adequacy, publishes the adequacy list and re-evaluates it at least every 3 years (art. 100), and can ban or order cessation of transfers (art. 101). Non-adequate destinations ride the art. 102 derogations (express consent, contract necessity, contract in the data subject's interest, public interest, legal claims, vital interests, public register - textually addressed to non-AU countries), Commission authorisation on sufficient guarantees, or a Council-of-Ministers decree for art. 71 processing; regular control under art. 103; health-research transfers of non-coded data have a specific regime (art. 93). (Verified from the archived JO text 2026-07-11, S27.)

Breach notification

Notify the CNDP within 72 hours of becoming aware unless the breach is unlikely to pose a risk; data subjects notified without undue delay for high-risk breaches; notification failures are criminal offences.

Penalties

Administrative fines up to DJF 70,000,000 or, for undertakings, 5% of global annual turnover, whichever is higher, plus warnings, formal notices, injunctions with astreintes, authorisation withdrawal and data locking; criminal offences (unlawful sensitive-data processing, fraudulent collection, unauthorised transfers, obstruction of the CNDP, etc.) carry up to 10 years' imprisonment and fines up to DJF 35,000,000.

Authority

Commission Nationale de la Protection des Données Personnelles (CNDP; created by the Digital Code, being constituted)

Verified 2026-07-10