Ethiopia: Implemented Personal Data Protection Proclamation (Proclamation No. 1321/2024) including data localisation requirements

On 24 July 2024, the Personal Data Protection Proclamation enters into force. The proclamation mandates that data controllers and processors must store locally collected personal data on servers in Ethiopia. It also provides that critical data requires local processing as prescribed by the Authority. The proclamation emphasises that personal data must be stored only for the period necessary to fulfil its purpose or as defined by law. It allows indefinite retention in cases such as legal requirements, consent, lawful purposes, or for historical, statistical, literary, and research purposes.