Cybersecurity regulation in South Sudan (2026)

Parliament (TNLA) passed the Cybercrime and Computer Misuse Bill and President Kiir signed the Act into law on 18 February 2026, which came into force immediately, replacing the earlier Cybercrimes and Computer Misuse Provisional Order 2021.

The Act standardizes offences such as hacking, identity theft and cyberstalking, regulates online conduct and social media, and provides for international cooperation and extradition in cyber cases.

Among its stated goals is protection of critical infrastructure including banking, telecommunications and government databases.

Under Section 32 the designated authority (NCA) is the lead national responder to cyber threats and must establish a National Computer Incident Response Team Coordination Centre (SS-CIRT/CC) to provide technical analysis, issue alerts/advisories, run awareness training and operate a platform for reporting cyber incidents.

The Act creates a National Cybercrime Prosecution Unit under the Ministry of Justice and Constitutional Affairs; the ICT Ministry, in collaboration with the NCA and law enforcement, is responsible for operationalizing the Act.

South Sudan has no comprehensive personal-data-protection law and is not party to the AU Malabo Convention; the government says a first-ever Data Protection Bill (establishing a Data Protection Commission) is being prepared for 2026 to complement the cybercrime Act.