Data protection & privacy law in South Sudan (2026)
Data protection in South Sudan: no framework.
South Sudan has no dedicated or comprehensive data-protection regime and no data-protection authority. Personal privacy is protected in general terms by the 2011 Transitional Constitution and touched on by the 2013 access-to-information law and the recently enacted cybercrime law, but none establishes GDPR-style data-subject rights or controller obligations. The government has stated it intends to introduce the country's first Data Protection Bill in 2026.
Legal framework
No comprehensive personal-data protection law. Privacy rests on Article 22 of the Transitional Constitution (2011); related rules appear in the Right of Access to Information Act (2013) and the Cybercrime and Computer Misuse Act (signed 2026). No data-protection supervisory authority exists; a dedicated Data Protection Bill is announced for 2026.
Key points: data & privacy in South Sudan
No comprehensive law
There is no standalone data-protection statute defining lawful processing, data-subject rights, or controller/processor duties, and no designated supervisory/data-protection authority to enforce compliance.
Constitutional basis
Article 22 of the Transitional Constitution of the Republic of South Sudan (2011) guarantees the inviolability of private life, protecting against unlawful interference with one's private life, family, home, or correspondence, except as provided by law.
Access-to-information privacy exemption
The Right of Access to Information Act, 2013 (No. 65 of 2013) requires public bodies to disclose information but exempts disclosures that would compromise an individual's privacy, a narrow privacy carve-out rather than a data-protection regime.
Cybercrime law mandates data retention
The Cybercrime and Computer Misuse Bill 2025 was passed unanimously by the Transitional National Legislative Assembly on 25 Nov 2025 and signed by President Salva Kiir (enacted early 2026); it requires service providers to retain subscriber communications, personal and traffic data for 180 days, an obligation criticized as privacy-eroding rather than privacy-protective.
Data Protection Bill announced for 2026
Government officials have stated South Sudan will introduce its first-ever Data Protection Bill in 2026 to address the legal gaps of its growing digital economy; as of May 2026 no such law is in force.
No supervisory authority
No data-protection authority has been established. The National Communication Authority (NCA) regulates telecoms and issues cybersecurity guidance, but it is not a personal-data supervisory body, and existing privacy provisions lack enforcement mechanisms.
Sources
- dataprotection.africa/south-sudan/
- dataguidance.com/jurisdiction/south-sudan
- faolex.fao.org/docs/pdf/ssd127441.pdf
- mofaic.gov.ss/wp-content/uploads/2023/03/Transitional-Constitution-of-the-Republic-
- ecolex.org/details/legislation/right-of-access-to-information-act-2013-no-65-of-
- leap.unep.org/en/countries/ss/national-legislation/right-access-information-act-201
- mojca.gov.ss/justice-ministry-introduces-cyber-crimes-computer-misuse-law/
- radiotamazuj.org/en/news/article/kiir-signs-cybercrime-audit-and-wildlife-bills-into-l
- eyeradio.org/cybercrime-and-computer-misuse-bill-2025-passed-by-assembly/
- radiotamazuj.org/en/news/article/south-sudan-to-get-data-protection-bill-in-2026-says-
Next for South Sudan: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026