Data protection & privacy laws in Yemen (2026)

Yemen has not enacted a GDPR-style personal-data protection statute. There is no general framework governing the collection, processing, storage, sharing or cross-border transfer of personal data by public or private bodies.

There is no independent data-protection authority (DPA) or regulator overseeing data-processing practices, handling complaints, or enforcing data-subject rights.

The Yemeni Constitution protects the confidentiality of postal, telephone, telegraphic and other communications, which may not be monitored, searched, disclosed or seized except by judicial order in cases prescribed by law (Art. 53).

Law No. 13 of 2012 on the Right of Access to Information contains a provision barring any party from collecting, processing, storing or using a citizen's personal data contrary to the Constitution and laws in force — but it is not an operative data-protection regime.

The 2010 Electronic Transactions Law addresses e-signatures and digital contracts, and the Telecommunications Law guarantees confidentiality of communications subject to judicial-authorized interception, but neither establishes data-subject rights or data-controller obligations.

Civil-society and digital-rights groups report widespread surveillance of activists, journalists and opponents and a near-total absence of data safeguards, with no realistic prospect of comprehensive legislation while the war and institutional split persist.