Somalia Data Protection Authority (DPA)

What Somalia Data Protection Authority (DPA) does

The Somalia Data Protection Authority (DPA) is the national independent regulatory body established under Data Protection Act No. 005 (2023) and headquartered on Aden Adde Airport Road in Mogadishu. It is mandated to protect personal data, uphold privacy rights, and promote responsible data practices across all sectors in Somalia, operating independently in its regulatory, supervisory, and enforcement functions under the oversight of the Ministry of Communications and Technology. The Authority serves all data-handling entities in Somalia — including private companies, government institutions, NGOs, educational institutions, healthcare providers, individuals, and Data Protection Officers — covering approximately 18 million citizens. Its mandate is organized into five core service areas: Registration & Licensing, Guidance & Standards, Complaints & Enforcement, Public Awareness & Training, and Policy & Advisory.

The DPA delivers its services through a digital service platform hosted at dpa.gov.so, which includes an AI-powered "DPA Assistant" chatbot for automated guidance, an online complaint and breach notification system enforcing a 72-hour breach reporting window, registration and licensing portals, and a downloadable library of forms and compliance templates. A physical headquarters in Mogadishu supplements the digital channels. Operational enforcement was formally activated when the Council of Ministers approved the implementing regulations under Law No. 005/2023 in January 2026, following the appointment of Mr. Mohamed Nur Ali as Director General in December 2024. The Authority is also an active member of the Islamic Data Protection Authority (IDPA), participating in its Executive Committee.

The Authority is a federal government entity (not a commercial enterprise) and generates funding through two channels: (1) registration and licensing fees from data controllers, processors, and DPOs required to register under the Act (specific fee schedules are not publicly disclosed), and (2) government budget allocation from the Federal Government of Somalia. Complaint filing by individuals is free of charge. As of the latest data, the organization operates with a headcount of approximately 26 employees and has no parent company or private ownership structure.

Name

Somalia Data Protection Authority (DPA)

Legal name

Data Protection Authority of Somalia

Website

https://dpa.gov.so

Company type

Private

Founded year

2023

Operating status

Operating

Headcount range

11–50 employees

Short description

The Somalia Data Protection Authority (DPA) is the national independent regulator established under Law No. 005 (2023) that protects personal data, enforces privacy rights, and oversees registration, complaints, and breach reporting across all sectors in Somalia, serving roughly 18 million citizens.

Ownership category

akta.pro rank

Product category

Data Protection Regulation

NAICS

Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors (92615)

SIC

Services-Management Services (8741), Services-Legal Services (8111)

akta.pro primary industry

Data Protection, Privacy & Cybersecurity Regulators (BPAIAOAH)

akta.pro secondary industries

Privacy Governance & Consent Management (HDADAIAI), Privacy Management (Consent, DSAR, RoPA) (HDADAFAH)

Keywords

• Data protection regulation
• Privacy compliance
• Regulatory authority
• Data breach notification
• Registration licensing

Headquarters

HQ city

Mogadishu

HQ country

Somalia

Offices1 record

Markets served

GTM type

B2B and B2C

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales, Infrastructure

Revenue model

1. Regulatory Fees and Licensing: The Authority generates revenue through registration and licensing fees from data controllers, processors, and Data Protection Officers who are required to register with the Authority under the Data Protection Act No. 005 (2023).
2. Government Budget Allocation: As a government authority under the Federal Government of Somalia, the DPA receives government funding to support its regulatory, supervisory, and enforcement functions.

Pricing tiers

Go-to-market motion1 record

Distribution channels4 records

Marketing channels4 records

Core offering

The Somalia Data Protection Authority is the national independent regulatory authority established under Data Protection Act No. 005 (2023) that protects personal data, upholds privacy rights, and promotes responsible data practices. It delivers five core regulatory services: Registration & Licensing for data controllers, processors, and DPOs; Complaints & Investigations for individuals; Data Breach Notification requiring 72-hour reporting; Guidance & Advisory Opinions on compliance; and Training & Capacity Building programmes.

Product overview

The Somalia Data Protection Authority operates as a unified regulatory platform offering five integrated core services under the Data Protection Act No. 005 (2023): Registration & Licensing for controllers, processors, and DPOs; Complaints & Investigations for enforcement; Data Breach Notification for incident reporting; Guidance & Advisory Opinions for compliance support; and Training & Capacity Building for awareness programmes. These services collectively enable the Authority to fulfill its mandate of protecting personal data, upholding privacy rights, and promoting responsible data practices across all sectors in Somalia.

Differentiator

Problem solved

Functional benefit

Products and services

• Registration & Licensing Mandatory registration and licensing service for organizations that collect, store, use, or otherwise process personal data in Somalia, including controllers, processors, and Data Protection Officers, required under the Data Protection Act No. 005 (2023).
• Complaints & Investigations Regulatory service enabling individuals to submit complaints concerning unlawful, unfair, or abusive processing of personal data, with the Authority investigating violations and issuing remedies and sanctions.
• Data Breach Notification Service enabling organizations to notify the Authority of personal data breaches that expose personal data, compromise confidentiality or security, or pose risks to the rights and freedoms of individuals, in compliance with the 72-hour notification requirement.
• Guidance & Advisory Opinions Official guidance and advisory opinions issued by the Authority to support consistent interpretation and application of the Data Protection Act, covering lawful processing, DPIAs, data sharing, and cross-border transfers.
• Training & Capacity Building Structured training, workshops, consultations, and capacity-building programmes for organizations, public institutions, and Data Protection Officers to promote data protection awareness and compliance.

Segments7 records

Ideal customer profiles6 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature2 records

Partnerships

One partnership is on record.

• Islamic Data Protection Authority (IDPA)coreStrategic or Co-development Partner · 19 January 2026Somalia DPA participates as a key member of the Islamic Data Protection Authority (IDPA), an organization bringing together heads and senior representatives of data protection authorities from IDPA member states. The partnership focuses on strengthening cooperation among Islamic countries in data protection, sharing experiences and expertise, advancing international and Islamic data protection standards, and addressing emerging challenges related to modern technologies and information security. Somalia's Director General actively participates in Executive Committee meetings to contribute to strategic plans for enhancing collaboration among member authorities.

Scale indicators5 records

Recent moves6 records

Expansion highlights4 records

Direct peers

• Egypt Data Protection Authority: Egypt's national data protection center within the Ministry of Communications and Information Technology. A fellow IDPA member state and a comparable Islamic-country regulator with legislative backing and enforcement responsibilities.
• Uganda Personal Data Protection Office: Uganda's national data protection authority operating under the Data Protection and Privacy Act. A direct regional peer with similar institutional mandate, fee-based registration model, and digital-first service delivery.
• Kenya Office of the Data Protection Commissioner (ODPC): Kenya's national data protection regulator established under the Data Protection Act, 2019. It is the most operationally mature peer in East Africa, sharing Somalia's regional context and Commonwealth-aligned legal tradition, and offers a comparable model for registration, enforcement, and complaints handling.
• Rwanda Data Protection Authority (RDPA): Rwanda's national data protection authority, a close peer sharing a shared East African context and an emphasis on digital government service delivery. RDPA provides a comparable model for technology-enabled regulatory services.
• Tanzania Personal Data Protection Authority: Tanzania's national data protection authority responsible for personal data oversight under the Personal Data Protection Act. A direct regional peer with similar enforcement, registration, and advisory functions.
• Morocco CNDP (Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel): Morocco's national data protection authority and IDPA member state. Comparable as a fellow IDPA participant and as a more mature North African/Islamic-country regulator with similar statutory mandate and enforcement powers.
• Ghana Data Protection Commission: Ghana's national data protection regulator, one of the earliest African data protection authorities. Directly comparable in mandate and operating model, particularly around DPO registration and sector-wide compliance.
• South Africa Information Regulator: South Africa's national data protection authority established under POPIA. A direct peer with statutory independence, broad regulatory mandate, and a model for cross-sector compliance oversight in an African context.
• Nigeria Data Protection Commission (NDPC): Nigeria's national data protection regulator, established under the Nigeria Data Protection Act, 2023 (the same year as Somalia's law). Comparable in scope, mandate, and African-market regulatory context, and substantially larger in scale.

Broad incumbents

• UK Information Commissioner's Office (ICO): The UK's independent data protection authority, considered a global benchmark for data protection regulation. It is not a direct competitor but serves as the broader incumbent whose GDPR-derived standards heavily influence the frameworks that newer African regulators like the Somalia DPA are modeled after.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat3 records

Key risks6 records

Key highlights6 records

Customer concentration

• LinkedInlinkedin.com/company/somalia-data-protection-authority

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Somalia Data Protection Authority (DPA)