Cybersecurity law & regulation in Marshall Islands (2026)

Legal framework

Cybersecurity Act 2025 (PL 2025-27); Cybercrimes Act 2025 (PL 2025-40); Ministry of Transportation and Communication (national cybersecurity authority)

Key points: cybersecurity in Marshall Islands

1. 01Cybersecurity Act 2025

   PL 2025-27, enacted in 2025, is the primary national cybersecurity law. It establishes a legal framework to prioritise cybersecurity, designates and protects critical information infrastructure, and creates a national computer-emergency/incident-response team (CERT). The Ministry of Transportation and Communication is the implementing authority.

   rmiparliament.org coe.int

2. 02Cybercrimes Act 2025

   PL 2025-40 introduced substantive criminal offences for cybercrime, addressing a gap identified by the Council of Europe Octopus project, which had previously noted that the Marshall Islands lacked cybercrime legislation beyond limited interception and forgery provisions in the 2011 Criminal Code.

   rmiparliament.org coe.int

3. 03Prior legal gap

   Before 2025, no comprehensive cybersecurity or cybercrime statute existed. The Criminal Code 2011 contained only Article 250 (unlawful interception/surveillance) and Article 224 (general forgery, not covering electronic means). Cybercrime bills had been under development since 2019 without enactment.

   coe.int itu.int

4. 04Breach notification & incident reporting

   The Cybersecurity Act 2025 mandates an incident-response framework and CERT structure; specific breach-notification timelines for private-sector entities have not yet been confirmed in publicly available secondary commentary, and a dedicated data protection authority has not yet been established.

   rmiparliament.org dig.watch

5. 05Capacity constraints & threat environment

   The Marshall Islands has been assessed as at high risk from state-sponsored cyber actors (including APT40, linked to China) targeting Pacific Island governments. Most government workers still use private email for official business, and few ministries have formal cybersecurity plans, underscoring the gap between legislative intent and operational capability.

   rnz.co.nz islandsbusiness.com

6. 06International cooperation & capacity building

   The Marshall Islands is a member of the Pacific Cyber Security Operational Network (PICSON) and has participated in U.S. State Department cybersecurity capacity-building programmes and Japan-funded NEC Security exercises (October 2024) for Pacific Island critical-infrastructure operators.

   itu.int nec.com

Sources

1. 1.rmiparliament.org/cms/library/public-laws-by-years/60-2025.html
2. 2.coe.int/en/web/octopus/-/marshall-islands
3. 3.itu.int/en/ITU-D/Cybersecurity/Documents/Country_Profiles/Marshall_Islands.pd
4. 4.digitalrmi.com/wp-content/uploads/2023/12/legislative-framework-assessment-digital-r
5. 5.rnz.co.nz/international/pacific-news/542444/marshall-islands-at-high-risk-of-cy
6. 6.islandsbusiness.com/news-break/marshall-islands-at-high-risk-of-cyber-attack/
7. 7.dig.watch/countries/marshall-islands
8. 8.nec.com/en/press/202410/global_20241011_01.html