Loi portant Code du numérique (Digital Code) (Djibouti)

Djibouti's Digital Code (Loi portant Code du numérique), approved by the National Assembly and enacted on 30 June 2025, is a broad 156-article statute that consolidates and modernises the legal framework for the entire digital sector, covering personal data protection, cybersecurity, cybercrime, electronic transactions and the wider digital economy. It was developed by the Agence Nationale de la Sécurité des Systèmes d'Information (ANSIE) together with the Ministry responsible for Posts and Telecommunications, and updates and replaces Djibouti's earlier 2014 framework. Book IV of the Code is specifically devoted to cybercrime. It defines more than 60 specific offences and substantially expands the legal arsenal against digital threats, criminalising offences against the confidentiality, integrity and availability of computer systems and data (illegal access, interception, and data and system interference), computer attacks, computer-related fraud and bank fraud, extortion and digital blackmail, identity-related offences and violations of privacy, alongside content offences. The Code also sets out procedural and investigative powers with an explicit cross-border dimension - digital searches, interception of communications, expedited preservation of data and international judicial cooperation are regulated in detail. Cybersecurity supervision and incident response sit with ANSIE, and a separate 2025 law (Loi n°195/AN/25/9ème L) provides for a National Cybersecurity Authority. On data protection, the Code establishes Djibouti's first comprehensive, GDPR-style regime governing the collection, processing, storage and transfer of personal data. It applies to automated processing and to non-automated processing forming part of a structured filing system, and introduces privacy-by-design obligations, data minimisation by default, and a 72-hour breach-notification requirement to the supervisory authority. Health-research processing requires prior authorisation. The Code creates numerous data-protection offences, with penalties for serious offences reaching imprisonment of up to 10 years and fines of up to 35,000,000 DJF, and designates the Commission Nationale de Protection des Données Personnelles (CNDP) - administratively and financially autonomous, with a multi-stakeholder composition - as supervisory authority. As at June 2026 the CNDP had not yet been operationally established, so no Regulator record is linked to this instrument. This record was created in a June 2026 data-protection sweep and updated in the June 2026 cybercrime sweep to reflect the Code's Book IV cybercrime provisions. Source language: French.

1. 1Consolidated 156-article Digital Code (enacted 30 June 2025) covering data protection, cybersecurity, cybercrime, electronic transactions and the digital economy; updates Djibouti's 2014 framework
2. 2Book IV devoted to cybercrime: 60+ offences including illegal access, interception, data and system interference, computer and bank fraud, extortion and digital blackmail, identity offences and privacy violations
3. 3Cybercrime procedural powers with a cross-border dimension: digital searches, interception, expedited data preservation and international judicial cooperation
4. 4Data protection: GDPR-style regime with privacy by design, data minimisation by default and 72-hour breach notification; prior authorisation for health-research processing
5. 5Criminal penalties for serious data-protection offences up to 10 years' imprisonment and fines up to 35,000,000 DJF
6. 6Designates the CNDP as data-protection supervisory authority (not yet operationally established as at June 2026); cybersecurity supervision with ANSIE, with a National Cybersecurity Authority provided for by Loi n°195/AN/25
7. 7Reviewer action: confirm Book IV provisions against the official Journal Officiel text; create Regulator records for the CNDP and ANSIE / National Cybersecurity Authority once constituted