Liberia

Liberia enacted its first comprehensive personal-data statute, formally titled An Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia, in 2026, after President Joseph Nyuma Boakai submitted it to the Legislature as a bill in June 2025.

Its own gazetted text, exact date of presidential assent, and statutory commencement date are not available from an official source, so its lawful-basis, data-subject-rights, cross-border-transfer, breach-notification, and enforcement provisions are not described here.

Before this Act, the Telecommunications Act of 2007 imposed a single sectoral confidentiality duty on a telecommunications service provider: to collect, use, maintain, and disclose customer information and communications only as permitted or required by law or with the customer's consent, to identify the purpose of any collection in advance, to keep that information accurate and up to date, to protect it with security safeguards appropriate to its sensitivity, and to answer for it even where an agent holds it.

That 2007 Act states no breach-notification duty, no data-subject access, correction, deletion, or objection rights, no cross-border-transfer restriction, no heightened rule for sensitive or biometric categories, and no dedicated supervisory authority or penalty regime for mishandling personal information, leaving a government authority's access to otherwise confidential customer information governed separately under the Act's national-security and interception provisions.

Liberia's Cybercrime Act of 2025, signed into law by President Joseph Nyuma Boakai, criminalizes gaining unauthorized access to a computer system, along with online fraud, identity theft, illegal interception, and electronic harassment; its own gazetted text is not available from an official source, so how authorization is read for a public, unauthenticated web page is not stated here.

No statute or case law addressing terms-of-service enforceability, or whether login or acceptance of terms changes the legal picture, exists.

Liberia's Intellectual Property Act of 2016 protects a compilation of data as a copyright work through the selection or arrangement of its contents, without a separate sui generis database right, and its private-copy exception expressly excludes the whole or a substantial part of a database in digital form; the Act contains no text-and-data-mining exception and no AI-training-specific carve-out.

Personal-data reach over scraped public personal data is governed by the Data Protection Act of Liberia, whose own gazetted text is likewise not available from an official source. No specific unfair-competition or misappropriation doctrine addressed to scraping, and no case law or regulatory statement giving robots.txt legal weight or addressing AI-training-specific access rules, exists.

Liberia's cyber-resilience posture for the private-sector duty-bearer rests on one narrow, sector-scoped safeguards duty inside its general telecommunications law, set against a much larger 2026 legislative wave whose operative text is not read here.

Section 51(5) of the Telecommunications Act 2007 requires a telecommunications service provider, whether the state-linked Liberia Telecommunications Corporation or a privately licensed operator, to protect customer information and customer communications in its custody with security safeguards appropriate to their sensitivity, a duty the Liberia Telecommunications Authority (LTA) enforces through its general investigatory and sanctioning powers and that the Act's own civil-liability section backs with a right of action for a customer who suffers loss from its breach.

President Joseph Nyuma Boakai signed the Cybercrime Act of 2025 into law on July 3, 2026, but the Ministry of Foreign Affairs' gazetted printing carries a text layer only on its cover page; every independent account of the Act's contents, an August 2026 disclosure by Post and Telecommunications Minister Sekou Kromah and a January 2026 report on the Senate's concurrence, describes it as criminalizing unauthorized access, digital fraud, identity theft, illegal interception and data misuse, establishing a Liberia National Cyber Security Council, and committing Liberia to the Budapest and Malabo Conventions, the intruder-offense and institutional-coordination shape the scraping topic covers rather than a duty on an operator's or manufacturer's own security posture, but the Act's own unread chapters leave that a researched gap rather than a settled absence.

The LTA has separately published a document titled Cybersecurity Regulations, dated February 2026, among its regulations for LTA licensees, but that PDF carries no extractable text beyond its filename, so its content is not described here.

President Boakai also signed Liberia's first Data Protection Act, officially titled "An Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia," on March 9, 2026; any security-of-processing duty it carries sits in Liberia's privacy-topic row rather than here, and its own gazetted printing has the same cover-page-only text layer.

No Central Bank of Liberia directive, regulation or guideline on its published Directives list or the first page of its Regulations list names cybersecurity or information-technology risk; the one CBL directive with "security" in its title, a 2010 Directive Concerning Security and Surveillance System at Financial Institutions, addresses physical premises security rather than systems security.

No Liberian instrument sets a general reasonable-security or information-security-programme baseline reaching a business with no sector gate, and no product-placement or market-entry security requirement for a connected device or software product is recorded here.

Liberia has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, no recognized hot-news misappropriation doctrine distinct from ordinary copyright law, and no located statute or case law addressing hyperlinking or framing liability specifically; each of those dimensions is a sourced absence rather than an unresolved question.

The relevant instrument is the Intellectual Property Act of 2016, which excludes the news of the day and miscellaneous facts having the character of mere items of press information from copyright protection outright, and separately permits a newspaper or periodical to reproduce, broadcast, or otherwise communicate to the public a current-issues article published in another newspaper or periodical unless the original publisher has expressly reserved that right.

The Act also permits a quotation from a lawfully disclosed work, including a quotation from a newspaper article or periodical in the form of a press summary, compatible with fair practice and accompanied by an indication of source and author; nothing limits that exception to short extracts, and no Liberian court decision applying it to a systematic news aggregator, as opposed to a traditional press review, exists.

The Act's exceptions predate the concept of a machine-readable text-and-data-mining reservation entirely, so no opt-out mechanism of that kind exists either.