Cybersecurity law & regulation in Eritrea (2026)

Legal framework

Communications Proclamation No. 102/1998; Eritrean Telecommunications Services Corporation Proclamation No. 134/2003; reported Cybercrime Proclamation No. 125/2019, no comprehensive cybersecurity law or data protection statute

Key points: cybersecurity in Eritrea

1. 01No comprehensive cybersecurity law

   Eritrea has not enacted a standalone national cybersecurity or information-security law. The ITU CyberWellness country profile and DataGuidance both confirm the absence of dedicated cybersecurity legislation, and Eritrea does not appear in the ITU National Cybersecurity Strategies Repository.

   itu.int dataguidance.com itu.int

2. 02Foundational telecom statutes (1998-2003)

   The principal in-force instruments are Communications Proclamation No. 102/1998 and Eritrean Telecommunications Services Corporation Proclamation No. 134/2003, both confirmed by the ITU legislation repository and the US Library of Congress. These govern the EriTel state monopoly but impose only minimal security obligations.

   itu.int loc.gov

3. 03Reported Cybercrime Proclamation (2019)

   Secondary sources reference a Cybercrime Proclamation No. 125/2019 covering hacking, online fraud, data breaches, and malware; however, this instrument does not appear in major intergovernmental databases or official government portals and should be treated with caution pending official confirmation.

   coe.int generisonline.com

4. 04No data protection law or breach-notification regime

   Eritrea has enacted no data protection statute; personal data is not legally defined, no supervisory authority exists, and there are no formal breach-notification or incident-reporting requirements on any sector. Data Protection Africa confirms this gap as of its latest fact sheet.

   dataprotection.africa dataguidance.com

5. 05No national cybersecurity strategy or dedicated agency

   Eritrea has not published a national cybersecurity strategy and has not established a dedicated national cybersecurity authority or CERT. The ITU CyberWellness profile notes the absence of any national governance roadmap for cybersecurity.

   itu.int cybilportal.org

6. 06Not party to international cybersecurity conventions

   Eritrea has not signed or ratified the Council of Europe Budapest Convention on Cybercrime. It has also not ratified the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), which entered into force in June 2023 but has been ratified by only a minority of AU member states.

   coe.int au.int

Sources

1. 1.itu.int/en/ITU-D/Cybersecurity/Documents/Country_Profiles/Eritrea.pdf
2. 2.coe.int/en/web/octopus/-/eritrea
3. 3.dataprotection.africa/eritrea/
4. 4.dataguidance.com/jurisdiction/eritrea
5. 5.itu.int/ITU-D/treg/Legislation/Eritrea/proclam.html
6. 6.loc.gov/item/eritrean-proc-134-2003/
7. 7.au.int/en/treaties/african-union-convention-cyber-security-and-personal-data
8. 8.itu.int/en/ITU-D/Cybersecurity/Pages/National-Strategies-Repository.aspx
9. 9.generisonline.com/an-overview-of-cybersecurity-regulations-in-eritrea/
10. 10.cybilportal.org/projects-by?page=country&_sft_country=eritrea