Processes personal data, in Sierra Leone

Cyber Security and Crime Act, 2021 (Act No. 7 of 2021), s. 53 (Reporting Cyber Threats) · Read the law's page

• Immediately inform the National Computer Security Incidence Response Team of an attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the Team within 7 days of its occurrence even if you already gave the immediate notice section 53(1) requires; failing to do so, without reasonable excuse, is itself an offence distinct from any liability for the disruption reported.
• This binds a person or institution that operates a computer system or network, whether public or private, not a licensed or sector-specific status; operating a computer system or network at all is enough to place an app in scope.
• The Act does not name a reporting channel, form, or contact point for the National Computer Security Incidence Response Team, unlike India's CERT-In directions or similarly detailed regimes; confirm the current reporting channel directly with the Team, housed within the Ministry of Communication, Technology and Innovation.

National Communications Authority Act, 2022 (Act No. 16 of 2022), s. 155(3)(h) · Read the law's page

• Do not transfer personal data outside Sierra Leone unless there is adequate proof that the recipient jurisdiction has adequate data protection laws.

National Communications Authority Act, 2022 (Act No. 16 of 2022), s. 190(1) · Read the law's page

• Do not collect, store, use or transmit subscriber information or such personal records without authorisation.

Telecommunications (Subscribers Identification and Registration) Regulations 2020 (S.I. No. 35 of 2020), reg. 22(3)-(4) · Read the law's page

• Do not transfer subscribers registration information outside Sierra Leone without the Commission's prior approval.
• Include, in any request for approval to transfer or use customer registration information outside the country, a justification of the purpose for which the data are required to be transferred.

Telecommunications (Subscribers Identification and Registration) Regulations 2020 (S.I. No. 35 of 2020), reg. 22(5)-(6) · Read the law's page

• Notify the Commission immediately where a subscriber's information is deliberately or otherwise disclosed in violation of the Regulations.