Cybersecurity law & regulation in Libya (2026)
Cybersecurity in Libya: sectoral rules.
Libya's cybersecurity regime rests primarily on a 2022 criminal cybercrime statute (Law No. 5/2022) that defines offences and penalties for unauthorised system access and electronic misconduct, alongside Law No. 6/2022 on electronic transactions. A 2024 ministerial decision introduced a licensing requirement for cybersecurity service providers overseen by NISSA, but there is no comprehensive positive-obligation cybersecurity law, no statutory breach-notification regime, and no national cybersecurity strategy yet in force.
Legal framework
Law No. 5 of 2022 on Combating Cybercrimes; Law No. 6 of 2022 on Electronic Transactions; Decision No. 150 of 2024 on Cybersecurity Services; National Information Security and Safety Authority (NISSA, est. 2013)
Key points: cybersecurity in Libya
Law No. 5/2022, Cybercrime Statute
Enacted by the House of Representatives and officially published 27 September 2022, the law criminalises unauthorised access, system disruption, and electronic fraud, with penalties ranging from fines and up to one year imprisonment for basic offences to heavier sentences for aggravated acts. It applies extraterritorially where effects occur in Libya.
Decision No. 150/2024, Cybersecurity Services Licensing
Issued by the Minister of Economy and Trade in 2024, this decision requires companies and individuals providing cybersecurity services to obtain a Practicing Permit from NISSA. Commercial licence renewal is conditional on holding a valid permit; existing operators were given a six-month compliance window.
NISSA, National Regulatory Authority
The National Information Security and Safety Authority was established by Decree No. 28 of 22 January 2013. Its standards, policies, and decisions are binding on all ministries and government entities. NISSA hosts Libya-CERT (the national computer emergency response team) responsible for prevention, detection, and mitigation of cyber threats.
No Breach-Notification or Incident-Reporting Obligation
As of 2025-2026, Libya has no statutory requirement for organisations to notify authorities or affected individuals following a data breach or cyber incident. DLA Piper's Data Protection Laws of the World confirms the absence of any breach-notification mandate.
No Comprehensive Data Protection Law or National Cybersecurity Strategy
Libya lacks a dedicated data protection statute and has not adopted a published national cybersecurity strategy. NISSA is mandated to develop such a strategy in coordination with the Ministry of Communications and Informatics, but it had not been formally adopted as of the latest available reporting.
Critical Infrastructure Gap & Human-Rights Concerns
The Libyan Technology Foundation identified the absence of critical infrastructure attack provisions as a significant gap in Law No. 5/2022. Separately, Access Now, Human Rights Watch, and ARTICLE 19 have called for repeal or major revision of the law, citing broadly worded offences used against journalists and activists.
Sources
- lawsociety.ly/en/legislation/law-no-5-of-2022-regarding-combating-cybercrimes/
- lawsociety.ly/en/legislation/decision-no-150-of-2024-on-regulating-the-activity-of-
- nissa.gov.ly/en/about/
- dlapiperdataprotection.com/index.html?t=breach-notification&c=LY
- dlapiperdataprotection.com/index.html?t=law&c=LY
- dig.watch/resource/libyas-law-no-5-of-2022-regarding-combating-cybercrimes
- ncsi.ega.ee/country/ly/
- coe.int/en/web/octopus/-/libya
- accessnow.org/press-release/libya-cybercrime-law/
- hrw.org/news/2023/04/03/libya-revoke-repressive-anti-cybercrime-law
- cybersecurityintelligence.com/national-information-security-and-safety-authority-nissa-libya-2761.h
Next for Libya: Starting a BusinessRestricted
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026