Cybersecurity law & regulation in Mozambique (2026)

Legal framework

Cyber Security Act & Cybercrimes Act (approved first reading by Parliament April 2026, not yet promulgated); National Cybersecurity Strategy 2021; INTIC as primary regulatory body

Key points: cybersecurity in Mozambique

1. 01Pending Comprehensive Law

   The Assembleia da República approved the Cyber Security Act and Cybercrimes Act 'na generalidade' (first/general reading) in April 2026. The Cyber Security Act covers protection of critical information infrastructure, national alert levels, incident coordination, and empowers a new National Cyber Security Authority to issue binding standards and sanctions. Further parliamentary stages and presidential assent are still required before it enters into force.

   intic.gov.mz techafricanews.com telecompaper.com

2. 02National Cybersecurity Strategy

   Mozambique's first National Cybersecurity Policy and Strategy were approved by the government and officially published in 2021 (covering the 2017-2021 cycle). The strategy set objectives to protect critical information infrastructure, establish a legal framework, promote information sharing, build technical capacity, and foster a national cybersecurity culture.

   dig.watch ncsi.ega.ee

3. 03Existing Sectoral & Criminal Rules

   Before the 2026 bills, cybersecurity obligations derived from the revised Penal Code (Law 24/2019), Law 3/2017 on Electronic Transactions, and a Council of Ministers-approved draft from 2024. The Penal Code criminalises unauthorised system access and electronic-payment fraud (1-3 year sentences). No cross-sector cyber-incident reporting duty exists in current enacted law.

   coe.int cadeproject.org

4. 04Banking Sector Breach Notification

   The only operative breach-notification obligation is sector-specific: Central Bank Notice 1/GBM/2014 (4 July 2014) requires banks to notify clients of security incidents involving personal data and to take all measures to prevent resulting harm. No equivalent general obligation applies to other sectors under current enacted law.

   dlapiperdataprotection.com theworldlawgroup.com

5. 05National CSIRT

   Mozambique launched its Computer Security Incident Response Team (CSIRT) in April 2023 under INTIC, with a nationwide mandate for cyber-incident detection and response. The CSIRT operates the national alert function pending formal statutory powers under the forthcoming Cyber Security Act.

   coe.int clubofmozambique.com

6. 06Personal Data Protection Bill

   A standalone Personal Data Protection Bill was published for public consultation on 5 September 2025. Mozambique subsequently consulted the Council of Europe (7 October 2025) to align the bill with international standards; it remains unenacted as of May 2026.

   mondaq.com intic.gov.mz

Sources

1. 1.intic.gov.mz/assembleia-da-republica-aprova-na-generalidade-a-lei-de-seguranca-cib
2. 2.techafricanews.com/2026/04/17/mozambique-parliament-approves-cybersecurity-and-cybercrim
3. 3.telecompaper.com/news/mozambican-parliament-approves-cybersecurity-and-cybercrime-laws
4. 4.itweb.africa/article/mozambique-passes-landmark-cybercrime-laws/P3gQ2qGA5DR7nRD1
5. 5.cadeproject.org/updates/mozambique-approves-draft-cybercrime-and-cybersecurity-bills-
6. 6.coe.int/en/web/octopus/-/mozambique
7. 7.dig.watch/resource/mozambiques-national-cybersecurity-policy
8. 8.ncsi.ega.ee/country/mz/
9. 9.dlapiperdataprotection.com/index.html?t=breach-notification&c=MZ
10. 10.clubofmozambique.com/news/mozambique-cyber-security-law-to-protect-the-state/
11. 11.mondaq.com/privacy-protection/1702808/mozambique-personal-data-protection-bill
12. 12.theworldlawgroup.com/membership/news/mozambique-data-breach-guide
13. 13.intic.gov.mz/wp-content/uploads/2025/11/Mozambique-Zero-Draft-2-Data-Governance-Po