Skip to content
World Watch

Cybersecurity law & regulation in Saint Lucia (2026)

Cybersecurity in Saint Lucia: sectoral rules.

Saint Lucia's cybersecurity regime rests on two primary statutes: the Computer Misuse Act 2011, which criminalises unauthorised access, fraud, and malicious communications, and the Privacy and Data Protection Act, which imposes security obligations on data controllers. No comprehensive national cybersecurity law or formally adopted national cybersecurity strategy is in force; institutional capacity, including a government Cyber Incident Response Team (CIRT), is still being built under the World Bank-funded Caribbean Digital Transformation Project (CARDTP), with CIRT recruitment planned for 2026.

Last verified Official sources first · MethodologyCompare Saint Lucia with other countries

Legal framework

Computer Misuse Act 2011 (Cap 13.17) and Privacy and Data Protection Act (Cap 8.18), overseen by the Data Protection Commissioner and the National Telecommunications Regulatory Commission (NTRC)

Key points: cybersecurity in Saint Lucia

  1. Computer Misuse Act 2011

    The Computer Misuse Act (Cap 13.17), revised to 31 December 2023, criminalises unauthorised access, interception, modification, electronic fraud, unlawful possession of hacking devices, and malicious communications. It is the primary cybercrime instrument but does not impose proactive cybersecurity obligations or incident-reporting duties on organisations.

    attorneygeneralchambers.com coe.int

  2. Data Protection Act, security & breach obligations

    The Privacy and Data Protection Act (Cap 8.18) requires data controllers to implement appropriate technical and organisational security measures and to register with the Data Protection Commissioner before processing personal data. Penalties for non-compliance reach EC$100,000 for corporate bodies. The Act came partially into force in 2023 with full enforcement targeting January 2025.

    attorneygeneralchambers.com govt.lc bartlettmorgan.com

  3. No comprehensive cybersecurity law or strategy

    The ITU Cyberwellness Profile confirms Saint Lucia has no officially approved national cybersecurity framework, no sector-specific cybersecurity certification regime, and no formally published national cybersecurity strategy as of the most recent assessment. The strategy and capacity layers remain under development.

    itu.int ncsi.ega.ee dig.watch

  4. CIRT establishment under CARDTP

    Under the World Bank Caribbean Digital Transformation Project (CARDTP), the OECS Commission engaged NRD Cyber Security to design a national government CIRT for Saint Lucia, covering governance, constituency, services, and a step-by-step roadmap. CIRT staff recruitment is set to begin in 2026, alongside a national government data centre. A public cybersecurity awareness campaign launched August 2025.

    thevoiceslu.com pressroom.oecs.int cardtpconnect.org

  5. Electronic Transactions Act 2011

    The Electronic Transactions Act 2011 (Act No. 16 of 2011) provides the legal basis for electronic contracts and transactions but does not contain specific cybersecurity incident-reporting or critical-infrastructure protection obligations.

    govt.lc oas.org

  6. No mandatory sector-specific incident reporting

    Saint Lucia has no NIS2-equivalent mandatory incident-reporting regime for critical infrastructure operators or financial institutions. The National Telecommunications Regulatory Commission (NTRC) under the Telecommunications Act oversees the telecoms sector but no published cybersecurity incident-notification obligations attach to it.

    itu.int dig.watch

Sources

  1. attorneygeneralchambers.com/laws-of-saint-lucia/computer-misuse-act
  2. attorneygeneralchambers.com/laws-of-saint-lucia/data-protection-act
  3. govt.lc/privacy-data-prot
  4. itu.int/en/ITU-D/Cybersecurity/Documents/Country_Profiles/Saint_Lucia.pdf
  5. ncsi.ega.ee/country/lc/
  6. thevoiceslu.com/2026/03/cardtp-initiates-bold-cybersecurity-measures/
  7. pressroom.oecs.int/new-plans-for-improved-cybersecurity-in-the-oecs-with-caribbean-digit
  8. cardtpconnect.org/cardtp-set-to-roll-out-cybercrime-and-cybersecurity-awareness-campaig
  9. coe.int/en/web/octopus/country-wiki/-/asset_publisher/wM2oCWukY7tM/content/sa
  10. dig.watch/countries/saint-lucia
  11. bartlettmorgan.com/2023/03/24/saint-lucia-brings-its-privacy-law-into-force/
  12. govt.lc/legislation/electronic-crimes-bill
  13. oas.org/juridico/english/cyb_sla.htm

Next for Saint Lucia: Starting a BusinessEasy

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026