Skip to content
World Watch

Cybersecurity law & regulation in Bhutan (2026)

Cybersecurity in Bhutan: sectoral rules.

Bhutan has no single comprehensive cybersecurity statute; cybersecurity obligations are distributed across the ICMA 2018, which criminalises cybercrime and mandates breach notification through BICMA, and relevant Penal Code provisions. The Government Technology Agency (GovTech) launched the inaugural National Cybersecurity Strategy 2024-2029 in October 2024, which explicitly identifies the absence of a dedicated cybersecurity law as a gap and calls for a new legislative framework as one of its four core goals. A review of the ICMA to bolster cybersecurity has been announced but no standalone law is yet in force.

Last verified Official sources first · MethodologyCompare Bhutan with other countries

Legal framework

Information, Communications and Media Act (ICMA) 2018 (enforced by BICMA); Penal Code cyber-offence provisions; National Cybersecurity Strategy 2024-2029 (GovTech/BtCIRT)

Key points: cybersecurity in Bhutan

  1. ICMA 2018, principal instrument

    The Information, Communications and Media Act 2018 is Bhutan's main digital law. It criminalises unauthorised access to Critical Information Infrastructure, unlawful data disclosure, payment-system interference, unsolicited email, and related offences, and empowers BICMA to regulate ISPs, telecom operators, and online content providers.

    bhutanwiki.org asianlii.org

  2. 72-hour breach-notification duty

    Organisations that discover a personal-data or security breach must notify the Bhutan InfoComm and Media Authority (BICMA) within 72 hours, disclosing the breach's nature, categories of data affected, likely consequences, and remedial measures taken.

    btcirt.bt generisonline.com

  3. Penal Code cyber-offence provisions

    Sections 463-472 of Bhutan's Penal Code criminalise cyber trespass, cyber fraud, identity theft, data theft, cyber extortion, dissemination of illegal content, cyberbullying, and online defamation, providing a supplementary criminal-law layer to the ICMA.

    lawgratis.com

  4. National Cybersecurity Strategy 2024-2029

    Launched 25 October 2024 at the National Cybersecurity Conference, this is Bhutan's first national cybersecurity strategy. Its four pillars are: (1) institutional framework, (2) legislative framework enhancement, (3) critical information infrastructure protection, and (4) incident management. It acknowledges that dedicated cybersecurity legislation is absent and must be developed.

    tech.gov.bt tech.gov.bt dig.watch

  5. BtCIRT, national incident-response body

    The Bhutan Computer Incident Response Team (BtCIRT), operating under GovTech, is the national CERT. It monitors government networks, data centres, and national critical ICT infrastructure, coordinates incident response, and handled 204 cybersecurity incidents in 2024 alone.

    btcirt.bt tech.gov.bt

  6. ICMA review and legislative gaps

    GovTech has publicly announced a review of the ICMA to bolster cybersecurity obligations. The NCS 2024-2029 identifies specific legislative gaps, including absence of a standalone cybersecurity act and limited enforcement capacity, and commits to remedying them within the strategy period. Bhutan is not a signatory to the Budapest Convention on Cybercrime.

    kuenselonline.com kuenselonline.com coe.int

Sources

  1. tech.gov.bt/national-cybersecurity-strategy/
  2. tech.gov.bt/wp-content/uploads/2025/05/National-Cybersecurity-Strategy_Published.
  3. btcirt.bt/
  4. bhutanwiki.org/articles/information-communications-media-act-2018
  5. kuenselonline.com/govtech-to-review-icm-act-to-bolster-cybersecurity/
  6. kuenselonline.com/beefing-up-the-countrys-cybersecurity-through-investment-legislation-
  7. dig.watch/resource/national-cybersecurity-strategy-of-bhutan-2024-2029
  8. coe.int/en/web/octopus/-/bhutan
  9. tech.gov.bt/cybersecurity-division/
  10. asianlii.org/bt/legis/laws/bicama2006402/
  11. generisonline.com/understanding-cybersecurity-regulations-in-bhutan-an-overview/
  12. lawgratis.com/blog-detail/cyber-law-at-bhutan
  13. btcirt.bt/about-us/

Next for Bhutan: Starting a BusinessModerate

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026