in forcenot yet in forceblocked by a courtproposedno longer in force
Privacy law4 instruments, 4 in force
Research summary (201 words)
Libya has no comprehensive data protection statute and no data protection specific supervisory authority; its personal data rules sit in Chapter Seven of Law No. 6 of 2022 Concerning Electronic Transactions, issued by the House of Representatives and in force since .
That chapter binds a public entity or authentication service provider that collects personal data in connection with issuing, maintaining, or facilitating an electronic authentication certificate, and, more broadly, any person who controls personal data by virtue of their work in electronic transactions.
The National Authority for Information Security and Safety is the law's general regulator and licenses the authentication service providers Chapter Seven binds, but no provision gives it, or any other body, an explicit power to investigate, penalize, or hear a complaint about a violation of the personal data duties themselves.
Article 81's criminal penalty is stated for the offences article 80 lists, which are forging or misusing an electronic signature, record, or authentication certificate and providing authentication services without a license, rather than the personal data restrictions article 79 states, so the text does not clearly arm a separate criminal penalty or private right of action for a breach of the personal data duties themselves.
Law No. 6 of 2022 Concerning Electronic Transactions arts. 73-75 (Protection of Personal Data: lawful basis, purpose limitation and confidentiality)The Law Society of Libya (Almajma Legal Directory) legislation database
In force since .Binds public and private bodies.
What this law does
Article 73 requires a public entity or an authentication service provider to obtain a person's explicit consent before collecting their personal data, and confines any collection to the purpose of issuing, maintaining, or facilitating a certificate, absent the person's further explicit consent to a different purpose.
Article 74 lists narrow grounds on which collecting, disclosing, providing, or processing personal data is otherwise legitimate without that consent, including a criminal investigation, a court decision, a tax assessment, or protecting a person's vital urgent interest.
Article 75 binds the authentication service provider to follow appropriate procedures to ensure the confidentiality of personal data in its custody, and bars disclosing, transferring, declaring, or publishing it without the data subject's prior consent.
Article 78 requires due consideration of an appropriate level of protection before personal data is transferred outside Libya, naming six factors: the nature of the personal data, the source of the information, the purposes and duration of the processing, the destination country and its international commitments and applicable law, the relevant rules in that country, and the security measures taken to protect the data there.
The provision states a multi factor due consideration test rather than a prior authorization requirement, an adequacy finding, or a localization mandate.
Article 76 requires any person who controls personal data by virtue of their work in electronic transactions to give the data subject, before processing, a special notification identifying who is responsible for the processing and the nature, purpose, methods, and locations of the processing.
Article 77 requires the authentication service provider to let the person whose data was collected access and update it, including all personal data sites related to them, through appropriate technological means. Article 79 bars sending electronic documents to a person who has explicitly refused them, bars processing personal data against the data subject's explicit refusal, and bars processing that causes harm to, or infringes the rights or freedoms of, the person the data was collected from.
Article 79 also bars using personal data for a purpose other than the one agreed to without the data subject's consent, echoing article 73's purpose limitation from the data subject's own side.
The law's definitions article names the National Authority for Information Security and Safety as its Authority, and article 27 makes that Authority responsible for accrediting and monitoring the electronic authentication processes and sites through which the entities chapter seven binds collect personal data.
Article 80 bars providing authentication services without a license from that Authority, alongside a further list of prohibited acts concerning forged or misused electronic signatures, records, and authentication certificates.
Article 81 punishes an act listed in article 70 or article 80, which includes the unlicensed provision of authentication services, with imprisonment of not less than one year and a fine of between three thousand and ten thousand dinars, rising to a fine of not less than ten thousand dinars where the act disrupts a government, military, security, or banking transaction.
Article 82 extends the same penalties to the legal representative of a legal person whose failure to perform their duties contributed to the offence, and makes the legal person jointly liable for any financial penalty or compensation where the offence was committed on its behalf.
Article 81's penalty is stated for the offences article 80 lists rather than the personal data restrictions article 79 states, so the text does not clearly arm a separate criminal penalty for a breach of the personal data duties themselves, and no provision gives the Authority or any other body a stated power to investigate or hear a complaint about such a breach.
Libya's computer-misuse framework is Law No. 5 of 2022 Concerning Combating Cybercrimes, issued by the House of Representatives and in force since its issuance on . Unauthorized access to a computer system, information network, or website is an offence only where its protection measures are intentionally breached, so a public, unauthenticated page carrying no such measure falls outside the offence.
No statute or reported case addresses terms-of-service enforceability or the effect of login or acceptance of terms, and robots.txt carries no statutory weight one way or the other.
Law No. 9 of 1968 Issuing the Copyright Protection Law denies separate copyright protection to a collection or anthology of works as such, protecting only the individual works it contains, so Libya has no sui generis database right; the law predates the internet and states no text-and-data-mining exception or machine-readable opt-out mechanism.
Article 11 of Law No. 5 of 2022 makes accessing a computer system, information system, information network, or website unlawful only where its protection measures are intentionally breached, wholly or partially, without authorization or in violation of an authorization.
Article 12 punishes unauthorized access with up to one year's imprisonment or a fine of 100 to 500 Libyan dinars, rising to at least one year and 500 to 5,000 dinars where the access deletes, alters, discloses, or copies data or disables or defaces a system, and to imprisonment and a fine of no less than 10,000 dinars where the access disables an information system or disrupts a network's operation.
Article 10 separately prohibits influencing an electronic system, network, or record by obtaining, disclosing, transmitting, or publishing a password, code, or other confidential data with intent to gain an unauthorized benefit or harm another.
Article 13 punishes intercepting an information system to obtain digital data with at least one year's imprisonment and a fine of 1,000 to 5,000 dinars, and article 14 punishes possessing or distributing a device or program prepared to reveal passwords or access codes or to break protection measures with at least one year's imprisonment and a fine of 1,000 to 10,000 dinars.
Article 2 of Law No. 9 of 1968 lists the categories of work an author is protected in, covering written, artistic, dramatic, musical, photographic, and similar works, but article 4 excludes a collection comprising various works, such as an anthology, from protection as such, without affecting the copyright each contained work carries on its own; Libya has no separate sui generis database or compilation right.
Article 4 also excludes a collection of official documents, such as statutes, decrees, and judgments, from protection unless it is itself characterized by innovation or an original arrangement. The law predates networked computing and states no text-and-data-mining exception and no machine-readable reservation mechanism.
Libya has no press-publisher neighbouring right and no compelled platform-to-publisher bargaining regime.
Law No. 9 of 1968 Issuing the Copyright Protection Law permits a quotation or short extract from a published work where it is intended for criticism, discussion, education, or information and names the author and source, and lets a newspaper or periodical publish a quotation, summary, or short statement from another's work without the author's permission, or copy an article on political, economic, scientific, or religious discussion of public interest, unless the source publication has indicated that copying is prohibited.
The same law states that its protection does not extend to daily events and other occurrences having the nature of ordinary news, so a news fact carries no copyright claim in the first place rather than surviving one under a separate misappropriation doctrine. No statute or reported case addresses hyperlinking or framing, and no text-and-data-mining exception or machine-readable opt-out mechanism is in force; the 1968 law predates the concept.
Article 13 of Law No. 9 of 1968 permits analyses and short quotations from a published work where intended for criticism, discussion, education, or information, provided the author's name, if known, and the source are given.
Article 14 lets a newspaper or periodical publish a quotation, a summary, or a short statement from another's work or novel without the author's permission, and copy an article on political, economic, scientific, or religious discussion of public interest at a given time, as long as the source publication has not indicated that copying is strictly prohibited, but bars copying a scientific, literary, or artistic article, serial, or short story wholesale without permission; the source and author's name must always be given.
The same article states that the law's protection does not extend to daily events and other occurrences having the nature of ordinary news. Article 15 lets a newspaper or broadcaster publish or broadcast, as news and without the author's permission, a speech, lecture, or talk delivered at an open meeting of a legislative or administrative body or at a scientific, literary, political, social, or religious meeting addressed to the public.
Article 17 permits copying a short quotation, or a limited extract of a graphic, sculptural, or photographic work, in a school, literature, history, science, or art book, with the source and author's name always given.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
AI law
Libya has not enacted a binding statute imposing an AI-transparency or output-labeling duty: a duty to disclose that content is AI-generated, to label or watermark synthetic output, or to disclose that a user is talking to a bot.
On the Prime Minister of the Government of National Unity adopted a National Charter for Artificial Intelligence Ethics and launched a National Strategy for Artificial Intelligence 2026-2030 at a Tripoli ceremony supervised by the Minister of State for Digital Economy and Artificial Intelligence Affairs and attended by, among other officials, the chairman of the General Information Authority; neither document is a numbered law and neither creates an enforceable duty on a private party.
Libya's existing binding statutes touching AI-adjacent activity, Law No. 5 of 2022 Concerning Combating Cybercrimes and Law No. 6 of 2022 Concerning Electronic Transactions, criminalize conduct that could be carried out with AI tooling, such as unauthorized system access or forging an electronic signature or record, but impose no AI-specific duty.
As of .
Cybersecurity law
Libya has no general product-security or connected-device statute, no duty to report a vulnerability or a security incident to an authority on a stated clock, no sector cyber-resilience regime naming a digital service such as a social platform, marketplace, or search engine, and no baseline reasonable-security statute reaching a business generally that holds covered data.
The one substantive, currently-binding security-posture regime located binds a narrow licensed role rather than a general software product or platform: Law No. 6 of 2022 Concerning Electronic Transactions, issued by the House of Representatives and in force since , places its Chapter Three duties on a person or company licensed by the National Authority for Information Security and Safety to practise the activity of an authentication or certification service provider.
The Authority is charged with verifying that authentication service providers use means, software, and procedures that guarantee the confidentiality and security of signatures and electronic certificates, and a licensed provider must itself use reliable means for issuing, delivering, and storing certificates and take necessary measures to protect them from forgery, must maintain an electronic record of authentication certificates that is protected from any unauthorized changes, and is responsible for the accuracy of the authenticated information a certificate contains.
This role, a certification or authentication service provider under a licensing scheme run by a national authority, is not one the corpus's declared activity vocabulary currently expresses, so it is recorded here in prose rather than raised against a declared activity, and a developer whose product is not itself a licensed authentication or certification service provider is not reached by the lint on this account.
A separate chapter of the same Law, headed Methods of Protecting Electronic Transactions, describes rather than mandates a set of security techniques: encryption is used to protect electronic transactions and maintain the confidentiality of a message's content, and a further list of methods, including information-system encryption, firewalls, information filters, non-repudiation means, data and file encryption technologies, backup protection procedures, and anti-virus software, is stated as what is used to protect an information system generally.
Unlike the certification-provider duties described above, this chapter names no addressee obliged to adopt any of these methods and states no compliance threshold, so it does not amount to a baseline security duty a business generally must meet.
The Law repeatedly defers technical detail to an executive regulation, including the terms and conditions for a reliable electronic-signature creation system and the specifications an authentication service provider's protective means and procedures must meet, and no copy of that regulation was located, so what it might add to the duties described above is not established here.
A separate, more recent regime licenses the business of providing cybersecurity services itself, rather than reaching a software product or platform as such. The National Authority for Information Security and Safety, the same body Chapter Three's certification-provider duties answer to, was established by Council of Ministers Decision No. 28 of 2013.
Decision of the Minister of Economy and Trade No. 150 of 2024, in force from , requires a company or individual wishing to practise any of a listed set of cybersecurity services, including operating a security operations center, penetration testing, cybersecurity incident response, digital forensic analysis and reverse engineering of malicious software, and importing, selling, or developing systems, applications, and software used in cybersecurity operations, to hold a valid practicing permit issued by the Authority, and a commercial license or register for that activity may only be renewed once the permit has been obtained.
Decision of the Minister of Economy and Trade No. 213 of 2024, in force from , adds that every entity conducting cybersecurity-services activities must also obtain authorization from the General Intelligence Agency, and directs the National Authority for Information Security and Safety together with the commercial-registry and licensing offices to treat that authorization as a condition of issuing or renewing a cybersecurity-services license.
This duty attaches to the narrow class of a business that itself sells cybersecurity services within Libya, not to an ordinary software manufacturer or platform operator that merely uses such services, so it too is recorded here in prose rather than raised against a declared activity; a developer whose product is not itself in the business of providing cybersecurity services to others in Libya is not reached by the lint on this account.
Enforcement of the licensed-role duties described above is administrative.
The Authority grants, monitors, and can withdraw a certification-service-provider license and a cybersecurity-services practicing permit, and Law No. 6 of 2022's own criminal penalties attach to providing authentication services without a license from the competent authority and to forging or misusing an electronic signature, record, or authentication certificate, carrying imprisonment of not less than one year and a fine of not less than three thousand Libyan dinars and not exceeding ten thousand Libyan dinars, rather than to a breach of the confidentiality and security duties described above on their own terms.
No published enforcement record for either regime was located.
Libya's personal-data rules sit in Chapter Seven of the same Law No. 6 of 2022 and are catalogued on this jurisdiction's privacy-topic record; no breach-notification duty running to a data subject or to an authority was located in that chapter or elsewhere in Libyan law, so there is no breach-notice statute to name as this jurisdiction's privacy-topic counterpart.
As of .
Age gating law
Libya has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code. Law No. (5) of 1997 on childhood protection, issued by the General People's Congress of the former Jamahiriya government, defines a child as a person under sixteen and sets rules on marriage preconditions, health care, education, and labor, but its text contains no reference to the internet or an online service.
Law No. 5 of 2022 Concerning Combating Cybercrimes requires the National Authority for Information Security and Safety to block a website displaying pornographic material and criminalizes exploiting a minor in pornographic acts, but neither provision imposes an age-verification or age-gating duty on a service provider; the blocking duty runs to the state regulator, not to the publisher of the content.
As of .
Case law
No current case law for Libya AI law
No current case law for Libya privacy law
No current case law for Libya scraping law
No current case law for Libya cybersecurity law
No current case law for Libya communications law
No current case law for Libya content moderation law
No current case law for Libya product and AI liability law
No current case law for Libya digital accessibility law
No current case law for Libya age gating law
No current case law for Libya reuse law
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
