Liberia

Liberia's first standalone personal-data statute is formally titled An Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia. It addresses the protection of personal data and privacy as government services, financial transactions, communications, and commercial activities move increasingly online. President Joseph Nyuma Boakai submitted the Act to the Legislature as a bill in June 2025.

The President approved the Act on March 9, 2026, as the Ministry of Foreign Affairs' printed copy, printed on March 23, 2026, records. Post and Telecommunications Minister Sekou Kromah publicly announced on August 19, 2026 that the President had signed the Act into law. The Liberia Internet Governance Forum had already reported the same signing in a statement dated June 25, 2026.

Section 44 provides that the Act takes effect upon publication into handbills, and section 41 gives existing industries, businesses, and offices one year from the day the Act comes into force to comply. Section 2 gives the Act the short title "Personal Data Protection and Privacy Act of 2024".

The Act applies to the processing of all types of personal information by any natural or juridical person, including a personal information controller and a processor, in respect of residents of Liberia and the ECOWAS Region or beyond. Personal data must be collected for specified and legitimate purposes, processed fairly and lawfully, kept accurate, adequate and not excessive, and retained only as long as necessary.

Processing is permitted only if not otherwise prohibited by law and at least one listed condition exists: the data subject's consent, performance of a contract, compliance with a legal obligation, protection of vital interests, a national emergency or public authority function, or the legitimate interests of the controller or a third party unless overridden by the data subject's fundamental rights.

The processing of sensitive personal information and privileged information is prohibited except in the cases section 13 lists, which include the data subject's consent specific to the purpose.

A data subject is entitled to be informed of the processing, to be furnished stated information before entry into the system, to reasonable access on demand, to dispute and have corrected inaccurate information, to suspend, withdraw or order the blocking, removal or destruction of the information, and to be indemnified for damages. A data subject may obtain from the controller a copy of personal information processed by electronic means in a structured and commonly used format.

A controller must implement reasonable and appropriate organizational, physical and technical measures to protect personal information against accidental or unlawful destruction, alteration and disclosure and against other unlawful processing.

A controller must promptly notify the affected data subjects when sensitive personal information or other information that may enable identity fraud is reasonably believed to have been acquired by an unauthorized person and the acquisition is likely to give rise to a real risk of serious harm, describing at least the nature of the breach, the sensitive personal information possibly involved and the measures taken.

A controller is responsible for personal information under its control or custody, including information transferred to a third party for processing, whether domestically or internationally, and must use contractual or other reasonable means to provide a comparable level of protection while the information is processed by the third party. The Independent Information Commissioner administers the Act and may authorize trans-border transfers of personal data.

The Commissioner may issue cease and desist orders and impose a temporary or permanent ban on the processing of personal information. The Commissioner may also impose administrative and financial sanctions on data controllers. Unauthorized processing of personal information is penalized by imprisonment of one year and a fine of not less than L$25,000.

Concealing a security breach after learning of it and of the obligation to notify is penalized by imprisonment of two years and a fine of L$15,000 to L$30,000.

Liberia's Telecommunications Act of 2007 makes a telecommunications service provider responsible for customer information and customer communications in its own custody or control or in that of its agents.

The Act requires a service provider to operate its telecommunications network with due regard for the privacy of its customers, and bars it from collecting, using, maintaining, or disclosing customer information or customer communications except as permitted or required by law or with the customer's consent. It requires a service provider to identify the purposes for which customer information is collected at or before collection, and bars using customer information for an undisclosed purpose.

It requires a service provider to keep customers' information accurate, complete, and up to date for the purposes it is used for. It requires a service provider to protect customer information and customer communications with security safeguards appropriate to their sensitivity. It leaves a government authority's access to otherwise confidential customer information or communications governed separately by the Act's national security, public emergency, and traffic interception provisions.

Under its section 85 the Act takes effect immediately upon publication into handbill; no source stating the day of that publication has been located.

Liberia's Cybercrime Act of 2025 provides a legal, regulatory and institutional framework for the prohibition, prevention, detection, prosecution and punishment of cybercrimes in Liberia. Its offences include unlawful access to a computer system or infrastructure, unlawful interception of communications, unauthorized modification of computer data, system interference, computer related fraud and identity theft and impersonation. The House of Representatives passed the bill on 28 September 2023.

The Senate passed the bill on 20 November 2025. The President of the Republic approved the Act on 3 July 2026, as the Ministry of Foreign Affairs' printed copy records. Section 6(1) makes it an offence to intentionally access the whole or part of a computer system or infrastructure without authorization or exceeding authorization. The Act treats access as unauthorized where the person is not entitled to control access to the program or data and has no consent from a person entitled to give it.

The section 6(1) offence carries imprisonment of not less than two years or a fine of double the gain the defendant realized, and imprisonment alone where the offence produced no gain. The Act contains no commencement clause, and section 47(2) refers to its effective date without fixing one.

Liberia's Intellectual Property Act of 2016 protects a compilation of data or other material as a copyright work where its selection or arrangement constitutes an intellectual creation, but that protection does not extend to the underlying data or material itself. Liberia has no separate sui generis database right of the European kind.

The Act's private-reproduction exception, which otherwise permits a single copy of a published work for personal use, expressly does not extend to the whole or a substantial part of a database in digital form. The Act contains no text-and-data-mining exception and no AI-training-specific carve-out. The Act provides that it takes effect immediately upon publication into handbills. No handbill or other official record of the day of that publication has been located.

The Mobile Money Regulations define an authorized institution as a bank financial institution authorized to provide mobile money services or a mobile money provider licensed by the Central Bank of Liberia. Regulation 12 makes an authorized institution responsible for implementing appropriate security policies and measures intended to safeguard the integrity, authenticity and confidentiality of data and operating processes.

Regulation 12 also makes an authorized institution responsible for establishing an effective audit function to provide periodic review of the security control environment and critical systems. Regulation 31 provides for a fine of at least L$200,000 for each violation or each day of the violation, among other supervisory sanctions.

The Regulations apply to all banks and non-bank financial institutions and to any other entities duly authorized by the Central Bank and intending to provide electronic payment services. Regulation 9.0 says the integrity and adequacy of an e-payment service provider IT and security systems should at minimum cover an effective audit function over the security control environment and critical systems and an IT systems vulnerability assessment report.

Regulation 9.1 requires an e-payment service provider to implement a cyber-security policy that conforms with international standards and any other cyber-security standards the Central Bank will issue. Regulation 25.1 makes the Payment Card Industry Data Security Standards the approved standard for compliance for all ATMs in Liberia. Regulation 26.1 allows the Central Bank to impose administrative penalties of up to L$200,000.00 for a violation of the Regulations.

The Regulations take effect upon publication in the Official Gazette. The Liberia Official Gazette that publishes the Regulations is dated Wednesday, January 8, 2020.

The LTA Cybersecurity Regulations 2026 apply to all telecommunications service providers that own, operate or connect to telecommunications networks to provide telecommunications services in Liberia. Regulation 7.1 gives each telecommunications service provider one year from the effective date of the Regulations to complete the establishment of its Cybersecurity Unit.

Regulation 7.5 requires a provider to conduct penetration testing at least once a year and to maintain logs of security events for at least 12 months. Regulation 10.1 sets a fine of not more than USD 3,000 plus 0.15% of the preceding year annual gross revenue for a provider that fails to establish a Cybersecurity Unit. Under regulation 10.7, all penalties for violation become applicable one year after the effective date of the Regulations.

Section 51(5) of Liberia's Telecommunications Act 2007 requires a telecommunications service provider to ensure that customer information and customer communications in its custody or control are protected by security safeguards appropriate to their sensitivity, a duty distinct from the same section's data-handling rules on purpose limitation, consent and accuracy in subsections (1) through (4).

The Liberia Telecommunications Authority (LTA) enforces the Act through its general document-production, inspection and sanctioning powers under Section 79, and Section 80 lets a customer who sustains loss or damage from a violation of the Act bring a civil action directly against the responsible person. Under its section 85 the Act takes effect immediately upon publication into handbill; no source stating the day of that publication has been located.

Regulation 29 requires an authorized institution to promptly report to the Central Bank of Liberia any suspected or confirmed cases of fraud relating to the mobile money services, security breaches, any material service interruption or other significant issues. Regulation 29 requires monthly reports not later than the 10th day of the following month.

Regulation 9.1(d) requires all computer accesses, including messages received, and security violations, suspected or attempted, to be reported to the Central Bank of Liberia with follow-up action taken promptly.

Regulation 7.6 requires a telecommunications service provider to notify the LTA within 24 hours and customers or subscribers within 72 hours of security breaches and major cybersecurity incidents involving critical information infrastructure. Regulation 6.0 defines critical information infrastructure as interconnected information systems and networks that are essential for the functioning of a nation or society.

Regulation 7.9 requires a provider to submit semiannual reports detailing security updates and patches applied, detected vulnerabilities and corrective actions taken, and incident logs. Regulation 10.6 provides a fine of up to USD 25,000 and possible license suspension or revocation for continued non-compliance with a provider duty to report to the LTA.

Liberia's Intellectual Property Act of 2016 excludes the news of the day and miscellaneous facts having the character of mere items of press information from copyright protection outright, alongside official legislative, judicial, and administrative texts.

Once a work has been lawfully published, the Act permits a quotation from it, including a quotation from a newspaper article or periodical in the form of a press summary, provided the quotation is compatible with fair practice, does not exceed the extent justified by its purpose, and is accompanied by an indication of source and author.

The Act separately permits a newspaper or periodical to reproduce, broadcast, or otherwise communicate to the public a current-issues article published in another newspaper or periodical, unless the original publisher has expressly reserved that right. It also permits reproducing short excerpts of a work seen or heard in the course of a current event for the purpose of reporting that event.

Liberia has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright law, and no case law on hyperlinking or framed display. The Act provides that it takes effect immediately upon publication into handbills. No handbill or other official record of the day of that publication has been located.