Data & Privacy · South Sudan
Data protection & privacy law in South Sudan (2026)
South Sudan shaded by its data & privacy status
Data protection in South Sudan: no framework, under No comprehensive personal-data protection law. Privacy rests on Article 22 of the Transitional Constitution (2011); related rules appear in the Right of Access to Information Act (2013) and the Cybercrime and Computer Misuse Act (signed 2026). No data-protection supervisory authority exists; a dedicated Data Protection Bill is announced for 2026..
South Sudan has no dedicated or comprehensive data-protection regime and no data-protection authority. Personal privacy is protected in general terms by the 2011 Transitional Constitution and touched on by the 2013 access-to-information law and the recently enacted cybercrime law, but none establishes GDPR-style data-subject rights or controller obligations. The government has stated it intends to introduce the country's first Data Protection Bill in 2026.
Key points
There is no standalone data-protection statute defining lawful processing, data-subject rights, or controller/processor duties, and no designated supervisory/data-protection authority to enforce compliance.
Article 22 of the Transitional Constitution of the Republic of South Sudan (2011) guarantees the inviolability of private life, protecting against unlawful interference with one's private life, family, home, or correspondence, except as provided by law.
The Right of Access to Information Act, 2013 (No. 65 of 2013) requires public bodies to disclose information but exempts disclosures that would compromise an individual's privacy, a narrow privacy carve-out rather than a data-protection regime.
The Cybercrime and Computer Misuse Bill 2025 was passed unanimously by the Transitional National Legislative Assembly on 25 Nov 2025 and signed by President Salva Kiir (enacted early 2026); it requires service providers to retain subscriber communications, personal and traffic data for 180 days, an obligation criticized as privacy-eroding rather than privacy-protective.
Government officials have stated South Sudan will introduce its first-ever Data Protection Bill in 2026 to address the legal gaps of its growing digital economy; as of May 2026 no such law is in force.
No data-protection authority has been established. The National Communication Authority (NCA) regulates telecoms and issues cybersecurity guidance, but it is not a personal-data supervisory body, and existing privacy provisions lack enforcement mechanisms.
South Sudan - other topics
Data & Privacy in other countries
Last verified 5/24/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · Explore the full world map →