Cybersecurity regulation in Lebanon (2026)

Enacted October 2018, Law No. 81 combines electronic-transactions recognition with data-protection principles (purpose limitation, lawfulness, security) and requires data controllers to notify authorities of breaches. The Ministry of Economy and Trade is the designated enforcement authority, but practical enforcement remains minimal.

Lebanon criminalises hacking, unauthorised access, fraud, identity theft, and dissemination of malicious software. The Cybercrime and Intellectual Property Rights Bureau (est. 2006 under the Internal Security Forces) handles enforcement, though its legal basis — a memorandum of service rather than a formal law or decree — is contested.

Adopted by the Council of Ministers on 30 August 2019, the strategy set objectives through 2022 and proposed a National Cyber Security and Information System Agency (NCISA) under the Higher Council of Defense. As of 2025–2026 the NCISA has not been formally created and core strategy targets remain unimplemented.

The Telecommunications Regulatory Authority (TRA) acts as the principal cybersecurity body for the telecom sector, publishing guidance and coordinating incident response for licensed operators. The TRA maintains a dedicated cybersecurity portal but no general cross-sector mandatory incident-reporting framework is in force.

A voluntary Lebanon CERT was launched in 2019 by private-sector security experts and coordinates with ISPs, law enforcement, and international bodies. A National Cybersecurity Committee was formalised by Resolution 173 under the Prime Minister's authority, with a National Cybersecurity Coordinator appointed under Resolution 172.

Lebanon is a participant in the Council of Europe's Octopus/CyberSouth programme working toward Budapest Convention alignment, and is a signatory to the Paris Call. The 2024 ISOC Country Report scored Lebanon only 30.44/100 on cybersecurity readiness, reflecting absent cross-sector breach-notification duties, weak enforcement, and no NIS2-equivalent critical-infrastructure regime.