Cybersecurity law & regulation in Lebanon (2026)

Minister of Telecommunications Charles Hajj relaunched the TRA with Jenny Gemayel as new chair, restoring Lebanon's independent telecoms regulator and its mandate to define rules for security, data sovereignty, and sector licensing. The revival is a prerequisite for any enforceable sector-level cybersecurity regulation.

The website of the Meteorological Department at Beirut-Rafic Hariri International Airport was compromised for over nine hours, exposing persistent gaps in critical-infrastructure cybersecurity despite the 2019 National Strategy. The incident intensified civil-society demands for enforceable standards on state digital platforms.

Thousands of Hezbollah-linked pagers and walkie-talkies containing concealed explosives detonated simultaneously in Israeli Operation Grim Beeper, killing 42 people and injuring over 4,000. The first known large-scale hardware supply-chain attack highlighted Lebanon's extreme vulnerability to adversarial hardware interdiction affecting civilian infrastructure.

The CoE's CyberSouth regional programme, covering Lebanon, Jordan, Morocco, and Tunisia, concluded after delivering legislative-alignment support, judicial training, and cross-border cooperation frameworks. Lebanon received technical assistance on aligning its cybercrime provisions with Budapest Convention standards, though Lebanon has not formally acceded to the Convention.

Under EU counter-terrorism support, Civipol began mapping Lebanon's public, academic, and private cybersecurity actors as groundwork for the National Cyber Security and Information System Agency envisioned in the 2019 Strategy. The NCISA remains unestablished due to Lebanon's sustained political and economic crisis.

Lebanon's Cabinet approved its first National Cybersecurity Strategy, setting objectives across critical-infrastructure protection, incident response, awareness, and creation of a dedicated NCISA agency under the General Secretariat of the Higher Council of Defence. The strategy was never fully executed, no agency was created and the 2019-2020 economic collapse halted implementation.

Lebanese security professionals from government, industry, and academia formed Lebanon CERT as a free public-benefit body to coordinate incident response, share threat intelligence, and raise security awareness. Operating without a statutory basis, it functions as Lebanon's de facto national CERT in the absence of a government-run agency.

Parliament passed Lebanon's first personal data protection statute and primary cybersecurity-relevant law, covering data-processing obligations, electronic signatures, and cybercrime procedural provisions (Articles 72-74, 124). The law lacks a dedicated supervisory authority, assigning de facto oversight to the Ministry of Economy and Trade with limited specialist capacity; it entered into force March 2019.

The global HackingTeam breach exposed that Lebanon's ISF Cybercrime Bureau had purchased and deployed commercial spyware, including exploiting mobile-app vulnerabilities, against Lebanese citizens' devices. The revelations deepened civil-society concerns about the Bureau's lack of a legal statutory basis and its use as a censorship tool against journalists and activists.

The Internal Security Forces created Lebanon's first dedicated cybercrime enforcement unit through Service Memorandum 204/609, not by law or legislative decree, leaving the Bureau on contested legal footing. It became the de facto cybercrime investigator but has been repeatedly criticised for targeting journalists, bloggers, and political activists rather than limiting its remit to cyber offences.

Lebanon became the first Arab country to legislate a framework for communications interception, requiring judicial or ministerial authorisation capped at two-month durations. Despite forward-looking design, Cabinet implementing regulations were not adopted until 2009 and judicial oversight is widely described as nominal, creating a persistent gap between law and practice.