Cybersecurity law & regulation in North Korea (2026)
Cybersecurity in North Korea: sectoral rules.
North Korea (DPRK) has no comprehensive, NIS2-style cybersecurity law and no modern data-breach/incident-notification regime in the Western sense. Instead, security obligations are embedded in IT-control legislation, chiefly the Information Technology Law amended in 2022, which mandates state-standard security measures and registration for information systems, framed around regime control and 'self-reliant' technology rather than protecting private data subjects. The country operates a largely isolated national intranet (Kwangmyong) with all external traffic routed through a small number of foreign providers, reflecting a model of centralized state control rather than a transparent regulatory framework.
Legal framework
Information Technology Law (amended 2022) and related statutes (e.g., Software Industry Law, 2004), administered by DPRK state organs; there is no comprehensive, dedicated cybersecurity statute or independent data-protection authority. Cyber-related rules are embedded in broader state-control IT legislation.
Key points: cybersecurity in North Korea
Primary instrument: IT Law (2022)
The Information Technology Law, amended in 2022, has 5 chapters and 43 articles covering planning, implementation, infrastructure and state oversight of IT. It is the closest thing to a domestic cyber/information-security statute, but is oriented toward state control and technological self-reliance rather than risk-based cybersecurity protection.
Mandatory security measures & registration
Article 19 requires all information systems to establish security measures in line with state standards and to undergo mandatory review and registration; Article 27 requires IT equipment and software to be produced per state plans, promoting domestic 'our-style' IT. These are control/approval duties, not breach-protection rules.
No data-breach / incident-notification regime
There is no publicly documented data-protection law or breach/incident-reporting duty comparable to GDPR, NIS2 or South Korea's PIPA. Obligations to notify affected individuals or a regulator after a security incident do not exist in any verifiable DPRK statute.
Isolated network architecture (Kwangmyong)
Domestic computing runs on the closed national intranet Kwangmyong, largely cut off from the global Internet; the limited external connectivity is routed through China Unicom and Russia's TransTeleCom. This architecture functions as a de facto state security control rather than a published cybersecurity standard.
Related statutes and weak transparency
Adjacent laws include the Software Industry Law (2004) and a 2022 public-reporting (complaints) law, but DPRK legal texts are rarely published officially; most English-language texts come from researchers such as Daily NK, NK TechLab and Columbia's compendium, so coverage is incomplete and hard to verify against an official gazette.
State-controlled cyber apparatus, not civil regulation
Cyber capacity is concentrated in state organs such as the Reconnaissance General Bureau under the leadership; the DPRK is internationally known as a source of offensive operations (e.g., crypto theft) rather than as a jurisdiction with civilian cybersecurity compliance obligations for businesses.
Sources
- dailynk.com/english/digital-iron-curtain-inside-north-korea-revamped-information-
- dailynk.com/english/north-korea-2022-public-reporting-law-revealed-full/
- nktechlab.org/north-korean-law-database/
- kls.law.columbia.edu/content/compendium-north-korean-law-english-translation
- en.wikipedia.org/wiki/Internet_in_North_Korea
- en.wikipedia.org/wiki/Kwangmyong_(network)
- csis.org/programs/korea-chair/projects/korea-chair-project-archive/north-korea
- cisa.gov/news-events/cybersecurity-advisories/aa20-106a
Next for North Korea: Starting a BusinessRestricted
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026