Ethiopia

Summary

Ethiopia presents moderate crawling risk with a now-identifiable statutory framework. The Computer Crime Proclamation No. 958/2016 criminalises intentional and unlawful access to a computer system; publicly accessible pages carry implicit authorisation, so the offence is unlikely to be triggered by crawling openly accessible content, but a ToS prohibition or technical barrier can establish unlawfulness. Penalties are notably high — up to 20 years imprisonment for aggravated access offences involving critical infrastructure. The Personal Data Protection Proclamation No. 1321/2024 (Ethiopia's first comprehensive data protection law, published in the Federal Negarit Gazette on 24 July 2024, administered by the Ethiopian Communications Authority — ECA) applies to collection of personal data including from publicly available sources and has extraterritorial scope. The ECA is established as the enforcement authority; data controllers must register with the ECA; breach notification is required within 72 hours. Implementing directives were still pending as of early 2026 and none had been formally adopted. The Copyright and Neighbouring Rights Proclamation No. 410/2004 (amended No. 872/2014) protects original compilations and databases on an originality basis; fair dealing is narrow. No sui generis database right; no TDM exception. Ethiopia has NOT ratified the AU Malabo Convention. Both primary statutes are verified from official and secondary sources. Confidence raised to medium; record remains fast_moving given nascent ECA enforcement and pending implementing directives.