Cybersecurity law & regulation in Mali (2026)

Legal framework

Law No. 2019-056 of 5 December 2019 on the Suppression of Cybercrime; Law No. 2013-015 of 21 May 2013 on the Protection of Personal Data; regulators: APDP (data protection), AMRTP (telecoms/ICT regulation), AGETIC (government ICT agency); National Cybersecurity Strategy 2026-2030 adopted December 2025

Key points: cybersecurity in Mali

1. 01Cybercrime Law 2019

   Law No. 2019-056 of 5 December 2019 criminalises unauthorised system access, data and system interference, computer fraud, online child sexual abuse material, and cyberbullying. It transposes ECOWAS Directive C/DIR/1/08/11 and prescribes penalties of 6 months to 20 years imprisonment plus fines up to 20 million CFA francs; the law applies to any ICT offence committed wholly or partly on Malian territory.

   amrtp.ml matcl.gov.ml sgg-mali.ml

2. 02Personal Data Protection Law 2013

   Law No. 2013-015 of 21 May 2013 established the APDP (Autorité de Protection des Données à caractère Personnel) as an independent supervisory authority and requires prior APDP authorisation for data processing. Breach notification to the APDP is envisaged but the original text does not prescribe a fixed mandatory timeline for notification.

   amrtp.ml apdp.ml rapdp.org

3. 03National Cybersecurity Strategy 2026-2030

   On 3 December 2025 the Council of Ministers approved a decree adopting Mali's first National Cybersecurity Strategy and Action Plan 2026-2030, targeting improved governance coordination, a stronger cybersecurity culture across government and private sector, and protection of critical digital infrastructure; until this strategy no coordinated national framework existed.

   bamada.net ecofinagency.com saheltribune.com

4. 04Incident Response: CIRT Mali

   Law No. 2019-056 mandates the creation of a Computer Incident Response Team (CIRT Mali) and a Platform for Combating Cybercrime (PLCC) with a digital forensics laboratory. No formal mandatory incident-reporting duty for operators comparable to EU NIS2 is yet in force.

   cyberpolicyportal.org coe.int

5. 05Regulatory Institutions

   The APDP supervises data protection; the AMRTP (Autorité Malienne de Régulation des Télécommunications et des Postes) regulates telecoms and publishes official ICT legislation; AGETIC (Agence des Technologies de l'Information et de la Communication, created by Decree No. 05-002 of 10 January 2005) is the government ICT implementation agency.

   apdp.ml amrtp.ml cyberpolicyportal.org

6. 06ITU Maturity & Notable Incidents

   The ITU Global Cybersecurity Index 2024 places Mali at Tier 4 out of 5, indicating basic capabilities. Significant incidents motivating the 2026-2030 strategy include an August 2022 breach exposing 312,000 taxpayer records from the General Directorate of Taxes and a February 2023 attack on Bank of Africa Mali described as one of the largest ever recorded against a Malian financial institution.

   ncsi.ega.ee ecofinagency.com

Sources

1. 1.amrtp.ml/en/download/law-no-2019-056-of-december-05-2019-on-the-suppression-of
2. 2.amrtp.ml/en/download/law-no-2013-015-of-may-21-2013-on-the-protection-of-perso
3. 3.matcl.gov.ml/loi-n-2019-056-portant-repression-de-la-cybercriminalite
4. 4.sgg-mali.ml/JO/2019/mali-jo-2019-43.pdf
5. 5.apdp.ml/
6. 6.bamada.net/cybersecurite-au-mali-le-conseil-des-ministres-adopte-la-strategie-na
7. 7.ecofinagency.com/news-digital/1112-51302-mali-targets-stronger-infrastructure-protecti
8. 8.saheltribune.com/cybersecurite-le-mali-se-dote-dun-cadre-coordonne-pour-la-periode-202
9. 9.cyberpolicyportal.org/fr/states/mali
10. 10.ncsi.ega.ee/country/ml_2022/?allData=1
11. 11.coe.int/en/web/octopus/-/mali
12. 12.rapdp.org/en/node/44