Cybersecurity law & regulation in Monaco (2026)
Cybersecurity in Monaco: sectoral rules.
Monaco's cybersecurity regime is anchored in Law No. 1.435/2016, which transposed the Budapest Cybercrime Convention, criminalised cyberattacks, and imposed binding security and incident-reporting obligations on Operators of Vital Importance (OIVs) across critical sectors. Law No. 1.578 of July 2025 updated and stiffened these obligations, while Law No. 1.565/2024 introduced GDPR-aligned 72-hour personal data breach notification duties. A voluntary NIS2-aligned horizontal framework is under active preparation following Monaco's public commitment at the 2024 Assises de la cybersécurité.
Legal framework
Law No. 1.435 of 8 November 2016 on combating technological crime (OIV security obligations), as strengthened by Law No. 1.578 of 1 July 2025; Agence Monégasque de Sécurité Numérique (AMSN) as national cybersecurity authority; data-breach notification under Law No. 1.565 of 3 December 2024
Key points: cybersecurity in Monaco
Foundational cybersecurity law
Law No. 1.435 of 8 November 2016 on combating technological crime transposed the Budapest Convention, introduced criminal offences for unauthorised system access and cyberattacks, and mandated the Minister of State to secure the Principality's information systems. It also created the AMSN as the national supervisory authority.
OIV cybersecurity obligations
Ministerial Order No. 2018-1053 (as amended by Orders 2020-902 and 2023-556) sets mandatory technical and organisational security baselines for OIVs, requiring a Protection Plan, AMSN audits at least every three years, and prompt notification to the Minister of State of any incident affecting information systems. Ministerial Order No. 2025-533 of 3 October 2025 further enhanced the regime.
Law 1.578/2025, reinforced penalties
Law No. 1.578 of 1 July 2025 raised the maximum financial penalty for OIV non-compliance with security rules to €150,000 per infraction for individuals and five times that amount for legal entities, and introduced a digital identity wallet framework.
Breach notification duties
Law No. 1.565 of 3 December 2024 on personal data protection requires controllers to notify the APDP (data-protection authority) of personal data breaches without undue delay and within 72 hours; affected individuals must be notified where the breach poses a high risk to their rights.
AMSN and CERT-MC
The Agence Monégasque de Sécurité Numérique (AMSN), established 2015, is Monaco's national cybersecurity authority; it hosts CERT-MC, an accredited incident-response team that assists government entities and OIVs. A bilateral ANSSI-AMSN cooperation agreement was renewed for 2025-2030.
Proposed NIS2-aligned horizontal framework
Though not an EU member state, Monaco publicly committed to voluntary NIS2 alignment at the 2024 Assises de la cybersécurité. An inter-ministerial working group was established in January 2025 to prepare a draft bill covering broader entity scope with a 24h/72h/30-day incident-reporting ladder; no bill had been published as of mid-2025.
Sources
- journaldemonaco.gouv.mc/Journaux/2025/Journal-8755/Loi-n-1.578-du-1er-juillet-2025-portant-mo
- en.gouv.mc/Policy-Practice/Security/Digital-Security
- en.gouv.mc/Government-Institutions/The-Government/The-Ministry-of-State/Monaco-C
- amsn.gouv.mc/
- en.gouv.mc/Princely-Governement/News/Monaco-adopts-personal-data-protection-legi
- 99avocats.com/en/publications/law-no-1-578-of-1-july-2025-amending-various-digital-
- 99avocats.com/en/publications/cybersecurity-for-operators-of-vital-importance-ovis-
- legimonaco.mc/news/2023-10-03_5/
- dlapiperdataprotection.com/index.html?t=breach-notification&c=MC
- cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
- en.gouv.mc/Policy-Practice/A-Modern-State/News/25th-Assises-de-la-Cybersecurite-
- copla.com/blog/compliance-regulations/nis2-directive-regulations-and-implementa
Next for Monaco: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026