Provides telecom services, in Sierra Leone

Cyber Security and Crime Act, 2021 (Act No. 7 of 2021), s. 53 (Reporting Cyber Threats) · Read the law's page

• Immediately inform the National Computer Security Incidence Response Team of an attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the Team within 7 days of its occurrence even if you already gave the immediate notice section 53(1) requires; failing to do so, without reasonable excuse, is itself an offence distinct from any liability for the disruption reported.
• This binds a person or institution that operates a computer system or network, whether public or private, not a licensed or sector-specific status; operating a computer system or network at all is enough to place an app in scope.
• The Act does not name a reporting channel, form, or contact point for the National Computer Security Incidence Response Team, unlike India's CERT-In directions or similarly detailed regimes; confirm the current reporting channel directly with the Team, housed within the Ministry of Communication, Technology and Innovation.

Cyber Security and Crime Act, 2021 (Act No. 7 of 2021), ss. 7-8 (Critical National Information Infrastructure) · Read the law's page

• If your system, data, or traffic data is designated, meet the minimum standards, guidelines, rules, or procedures the Presidential Order prescribes, which section 7(2) requires to cover at least securing systems by default and logging system and user activity for audit, and permit the National Computer Security Incidence Response Team to audit and inspect the designated infrastructure at any time.
• This only binds a computer system, computer data, or traffic data the President has designated, by an Order published in the Gazette on the Minister's recommendation and in consultation with the National Cybersecurity Advisory Council, as Critical National Information Infrastructure; declaring a flagged activity alone does not put an app in scope, and no public register of designated infrastructure was located.

National Communications Authority Act, 2022 (Act No. 16 of 2022), s. 155(3)(h) · Read the law's page

• Do not transfer personal data outside Sierra Leone unless there is adequate proof that the recipient jurisdiction has adequate data protection laws.

National Communications Authority Act, 2022 (Act No. 16 of 2022), s. 190(1) · Read the law's page

• Do not collect, store, use or transmit subscriber information or such personal records without authorisation.

Telecommunications (Subscribers Identification and Registration) Regulations 2020 (S.I. No. 35 of 2020), reg. 22(3)-(4) · Read the law's page

• Do not transfer subscribers registration information outside Sierra Leone without the Commission's prior approval.
• Include, in any request for approval to transfer or use customer registration information outside the country, a justification of the purpose for which the data are required to be transferred.

Telecommunications (Subscribers Identification and Registration) Regulations 2020 (S.I. No. 35 of 2020), reg. 22(5)-(6) · Read the law's page

• Notify the Commission immediately where a subscriber's information is deliberately or otherwise disclosed in violation of the Regulations.