Cybersecurity law & regulation in Sudan (2026)

Legal framework

Law on Combating Cybercrimes 2018 (amended 2020), administered alongside the Telecommunication and Post Regulatory Authority (TPRA) and Sudan CERT; no comprehensive NIS2-style cybersecurity law and no general data-protection statute.

Key points: cybersecurity in Sudan

1. 01Primary criminal statute

   The Law on Combating Cybercrimes 2018 criminalizes illegal access, illegal interception and data interference, and was amended in July 2020 to increase prison terms, including raising the Article 23 'spreading fake news' offence to up to four years. It is enforcement/conduct-focused rather than an obligations framework for operators.

   cpj.org redress.org

2. 02Regulator / sectoral oversight

   Cybersecurity functions sit with the Telecommunication and Post Regulatory Authority (TPRA, formerly the National Telecommunication Corporation), the officially recognized body for national cybersecurity policy, applied mainly through the telecom sector.

   tpra.gov.sd itu.int

3. 03National CERT / incident response

   Sudan CERT, established in 2010 under the regulator, is the national first responder for information-security incidents, providing incident handling, digital forensics, advisories and awareness, operational capacity rather than a legal reporting mandate.

   tpra.gov.sd itu.int

4. 04Breach notification / incident reporting

   There is no identified general statutory breach-notification or mandatory incident-reporting obligation; reporting to Sudan CERT is largely voluntary/advisory, and the cybercrime law does not impose economy-wide reporting duties on data controllers or operators.

   itu.int dataprotection.africa

5. 05No general data-protection law

   Sudan has no comprehensive data-protection statute; privacy/security matters are addressed only through scattered sectoral instruments such as the Electronic Transactions Act 2007 and the cybercrime legislation.

   dataprotection.africa

6. 06International framework engagement

   Sudan is tracked in the Council of Europe Octopus cybercrime community and the ITU cyberwellness profile, which note partial alignment with substantive cybercrime provisions but a still-developing institutional and strategic framework.

   coe.int itu.int

Sources

1. 1.tpra.gov.sd/en/regulatory/cybersecurity/
2. 2.tpra.gov.sd/en/projects/sudan-cert/
3. 3.itu.int/en/ITU-D/Cybersecurity/Documents/Country_Profiles/Sudan_(Republic_of)
4. 4.redress.org/wp-content/uploads/2020/07/2-Sudan-Amendments-July-2020-English-REDRE
5. 5.cpj.org/2020/11/sudan-tightens-cybercrime-law-as-army-pursues-fake-news/
6. 6.coe.int/en/web/octopus/-/sudan
7. 7.dataprotection.africa/sudan/