Data protection & privacy law in Lebanon (2026)
Data protection in Lebanon: comprehensive law.
Lebanon has a generally-applicable personal data protection law, Law No. 81/2018, enacted on 10 October 2018 and in force since 31 March 2019, which sets out data-processing principles, data-subject rights, controller obligations and cross-border transfer rules across sectors. However, it does not create an independent data-protection authority; oversight rests with the Ministry of Economy and Trade, and practical implementation and enforcement remain very weak, with key procedures (and a definition of 'consent') still undeveloped years after enactment.
Legal framework
Law No. 81 of 10 October 2018 on Electronic Transactions and Personal Data (Title/provisions on Personal Data); supervised in practice by the Ministry of Economy and Trade (MoET)
Key points: data & privacy in Lebanon
In-force comprehensive law
Law No. 81/2018 ('Electronic Transactions and Personal Data') is enacted and applying since 31 March 2019. It combines e-transactions/e-signature rules with a generally-applicable personal data protection regime, rather than being limited to specific sectors.
No independent supervisory authority
The law does not establish a dedicated, independent data-protection regulator. The Ministry of Economy and Trade acts as de facto overseer (issuing declarations/licences), but lacks specialised capacity and accountability mechanisms.
Prior declaration / licensing regime
Collecting, processing and using personal data generally requires a prior declaration to the MoET. A licence (from the relevant minister) is required for sensitive categories such as national/state security data, criminal/judicial data, and health, genetic or sexual-life data; some processing is exempt.
Data-subject rights
The law affords rights including access to one's data, rectification of inaccurate data, objection/opt-out (notably to direct-marketing and automated processing), and review before the processing officer, though the scope is narrower and less precisely defined than under the EU GDPR.
Controller obligations and cross-border transfers
Processing must rest on the data subject's consent (which the law does not formally define) and follow principles of purpose limitation, proportionality, accuracy, security and confidentiality. Transfers abroad are allowed where the destination offers adequate protection, safeguards or explicit consent exist, or government approval is obtained.
Weak enforcement and implementation gaps
Sanctions for breaches are modest (fines roughly LBP 1m-30m) and, amid Lebanon's political and economic crisis, the MoET has not built out implementing procedures, staffing or filing channels, so the law is widely criticised as under-enforced and outdated in practice.
Timeline of decisions
- LawLaw 140/1999, Telecommunications Interception Act Enacted
Lebanon became the first Arab country to legislate a framework for communications interception, requiring judicial or ministerial authorisation capped at two-month durations. Despite forward-looking design, Cabinet implementing regulations were not adopted until 2009 and judicial oversight is widely described as nominal, creating a persistent gap between law and practice.
CYRILLA Digital Rights Law Database
Sources
- smex.org/wp-content/uploads/2018/10/E-transaction-law-Lebanon-Official-Gazette
- dlapiperdataprotection.com/?t=law&c=LB
- dlapiperdataprotection.com/?t=authority&c=LB
- privacyinternational.org/state-privacy/1081/state-privacy-lebanon
- dataguidance.com/notes/lebanon-data-protection-overview
- clym.io/regulations/law-no-81-on-electronic-transactions-and-personal-data-le
- euromedmonitor.org/en/article/5630/Lebanon:-Data-protection-law-fails-to-protect-people%
Next for Lebanon: Digital Payments & FintechPartial
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 25 May 2026. Methodology & how to cite · State of Technology Regulation 2026