Djibouti

Summary

Djibouti enacted a comprehensive Digital Code on June 30, 2025, approved by the National Assembly following a two-year participatory drafting process. The Code comprises approximately 800 articles across eight volumes covering electronic communications, e-commerce, personal data protection (156 articles, GDPR-style), cybersecurity, and cybercrime. It establishes the CNDP (Commission Nationale de Protection des Données Personnelles) as the supervisory authority and introduces privacy-by-design, 72-hour breach notification, a legitimate-interest lawful basis, and penalties of up to 10 years imprisonment and DJF 70 million (approx. USD 393,000) or 5% of turnover. The CNDP had not been operationally constituted as of mid-2025, limiting active enforcement. Djibouti ratified the AU Malabo Convention in November 2023. The Digital Code's official law number has not been confirmed in available English-language primary sources but enactment on June 30, 2025 is well-documented across multiple secondary sources (Jones Day, TechAfrica News, ConsentStack, Lexology). No specific scraping statute, no TDM exception, no sui generis database right. Confidence raised to medium: enactment date and structure are well-corroborated; residual gap is unconfirmed official law number and CNDP non-operationalisation.