Namibia

Section 15(1)(a) excuses fair dealing in the use of a literary or musical work for the purpose of research or private study, or the personal or private use, of the person using the work. Section 15(1)(c) separately excuses fair dealing for the purpose of reporting on a current event in a newspaper, magazine or similar periodical, or by means of broadcasting or in a cinematograph film.

Section 16 permits a further reproduction of a work in circumstances to be prescribed, provided the reproduction does not conflict with a normal exploitation of the work and is not unreasonably prejudicial to the owner's legitimate interests, echoing the same three-step structure without creating a text-and-data-mining-specific exception or a machine-readable reservation mechanism.

Section 2 defines "literary work" to include "tables and compilations," so a database or dataset is protected, if at all, as a compilation-type literary work rather than under a separate sui generis database right; a computer program is expressly excluded from that definition and is instead a distinct category of protected work under section 14.

Paragraph 6 of the Determination of the Operational and Cybersecurity Standards within the National Payment System (PSD-12) applies it to all Financial Market Infrastructures, Designated Non-Bank Financial Institutions, participants of Financial Market Infrastructures, Retail Payment Systems, Payment Service Providers and any other entities licensed or authorised within the National Payment System.

Paragraph 9.1 of PSD-12 makes the boards of the entities it applies to responsible for information security, cybersecurity and operational resilience, and requires them to establish and approve a Framework. Paragraph 11.1 of PSD-12 requires an identification of business functions and supporting processes and a risk assessment at least once every year, or when a significant change affects them.

Paragraph 12.1 of PSD-12 requires encryption, tokenization or masking of the transmission of data across open and public networks in line with best practice standards. Paragraph 16 of PSD-12 says it becomes effective on 01 July 2023. Paragraph 15 of PSD-12 says any person that contravenes or fails to comply with any provision of it will be subjected to administrative penalties as provided for under the Act.

Section 16A(3) of the Payment System Management Act, 2003 lets the Bank of Namibia impose an administrative penalty not exceeding N$100 000 for each day of non-compliance, up to N$1 000 000 in total. Section 14(2) of the Payment System Management Act, 2003 makes contravening a determination made under section 14(1) an offence.

Paragraph 3 of the Determination on Information Security (BID-30) of 2017 applies it to all banking institutions authorised by the Bank to conduct banking business in Namibia and to the banking groups to which they belong. Paragraph 8 of the 2017 Determination makes the board of directors of each banking institution responsible for ensuring that an information security policy and program is established and implemented to comply with the Determination.

Paragraph 10.1 of the 2017 Determination says a banking institution should establish, implement and maintain an information security policy approved by the board. Paragraph 18.4 of the 2017 Determination says a banking institution should implement a methodology for vulnerability assessments and penetration testing and should ensure that the tests are conducted regularly and whenever systems are updated or deployed.

Part V of the 2017 Determination says that if a banking institution fails to comply, the Bank may pursue any remedial measures provided under the Act or any other measures the Bank may deem appropriate. Section 109(3) of the Banking Institutions Act, 2023 keeps a determination made under the repealed Banking Institutions Act, 1998 in force until it is repealed or amended under the 2023 Act.

Section 94(1) of the Banking Institutions Act, 2023 lets the Bank of Namibia, after an inquiry, impose on a banking institution, microfinance banking institution or controlling company that contravenes or fails to comply with a determination referred to in section 108(3) an administrative fine not exceeding an amount the Bank determines.

Paragraph 5 of the Determination on Information Security (BID-30) of 2026 applies it to all banking institutions and microfinance banking institutions authorised by the Bank to conduct banking business and microfinance banking business in Namibia. Paragraph 7.3.1 of the 2026 Determination requires a banking institution or microfinance banking institution to have in place a comprehensive information security framework.

Paragraph 10.5 of the 2026 Determination requires penetration testing on critical systems at least annually or more frequently in alignment with the institution's risk profile. Paragraph 11.3 of the 2026 Determination requires the institution to maintain and test data backup and restoration procedures regularly or at least quarterly. Paragraph 14 of the 2026 Determination brings it into effect six months after the date of publication in the Gazette.

Paragraph 15 of the 2026 Determination repeals the Determination on Information Security (BID-30) published in the Government Gazette on 24 October 2017. Paragraph 13.1 of the 2026 Determination says any contravention or failure to comply is subject to administrative penalties as contemplated in section 94(1) of the Act.

Section 94(1) of the Banking Institutions Act, 2023 lets the Bank of Namibia, after an inquiry, impose on a banking institution, microfinance banking institution or controlling company that contravenes or fails to comply with a determination referred to in section 108(3) an administrative fine not exceeding an amount the Bank determines.

Paragraph 6 of the Determination of the Operational and Cybersecurity Standards within the National Payment System (PSD-12) applies it to all Financial Market Infrastructures, Designated Non-Bank Financial Institutions, participants of Financial Market Infrastructures, Retail Payment Systems, Payment Service Providers and any other entities licensed or authorised within the National Payment System.

Paragraph 11.13 of PSD-12 requires all successful cyberattack incidents to be reported to the Bank, at least within 24 hours for the preliminary notification of the cyber incident. Paragraph 11.14 of PSD-12 requires the entity, after the reporting under paragraph 11.13, to conduct an impact assessment on the successful cyberattack incident and report to the Bank within a month from the time the incident becomes known.

Paragraph 11.15 of PSD-12 requires the reporting required by paragraph 11.14 to indicate at least any financial loss, data loss and availability loss. Paragraph 15 of PSD-12 says any person that contravenes or fails to comply with any provision of it will be subjected to administrative penalties as provided for under the Act.

Section 16A(3) of the Payment System Management Act, 2003 lets the Bank of Namibia impose an administrative penalty not exceeding N$100 000 for each day of non-compliance, up to N$1 000 000 in total. Section 14(2) of the Payment System Management Act, 2003 makes contravening a determination made under section 14(1) an offence.

Paragraph 3 of the Determination on Information Security (BID-30) of 2017 applies it to all banking institutions authorised by the Bank to conduct banking business in Namibia and to the banking groups to which they belong. Paragraph 17.1 of the 2017 Determination says a banking institution is required to report all material information security related incidents to the Bank immediately as and when it happens.

Paragraph 17.1 of the 2017 Determination says the banking institution should communicate with internal and external parties to ensure a coordinated response to incidents. Part V of the 2017 Determination says that if a banking institution fails to comply, the Bank may pursue any remedial measures provided under the Act or any other measures the Bank may deem appropriate.

Section 109(3) of the Banking Institutions Act, 2023 keeps a determination made under the repealed Banking Institutions Act, 1998 in force until it is repealed or amended under the 2023 Act.

Section 94(1) of the Banking Institutions Act, 2023 lets the Bank of Namibia, after an inquiry, impose on a banking institution, microfinance banking institution or controlling company that contravenes or fails to comply with a determination referred to in section 108(3) an administrative fine not exceeding an amount the Bank determines.

Paragraph 5 of the Determination on Information Security (BID-30) of 2026 applies it to all banking institutions and microfinance banking institutions authorised by the Bank to conduct banking business and microfinance banking business in Namibia.

Paragraph 12.1 of the 2026 Determination requires the institution to report immediately, on becoming aware of material information relating to an information or cyber security incident, to the Director of the Banking Supervision Department at the Bank by telephone or in writing, followed by regular updates until the incident is contained.

Paragraph 12.5 of the 2026 Determination requires the institution to submit information about the incident on a form issued by the Bank within 24 hours after detecting the incident, or the next working day where the incident occurred on a weekend or public holiday. Paragraph 14 of the 2026 Determination brings it into effect six months after the date of publication in the Gazette.

Paragraph 13.1 of the 2026 Determination says any contravention or failure to comply is subject to administrative penalties as contemplated in section 94(1) of the Act.

Section 94(1) of the Banking Institutions Act, 2023 lets the Bank of Namibia, after an inquiry, impose on a banking institution, microfinance banking institution or controlling company that contravenes or fails to comply with a determination referred to in section 108(3) an administrative fine not exceeding an amount the Bank determines.

Section 15(6) provides that the copyright in a lecture, address, or other work of a similar nature delivered in public is not infringed by its reproduction in the press or its communication in a broadcast, made for an informatory purpose.

Section 15(7) provides that the copyright in an article published in a newspaper, magazine, or similar periodical, or in a broadcast, on a current economic, political, or religious topic, is not infringed by its reproduction in the press or its communication in a broadcast, unless such reproduction or communication was expressly reserved when the article was first published or the work was broadcast, provided the source is clearly mentioned in the reproduction or communication.

Section 15(8) provides that no copyright subsists in the official text of a legislative, administrative, or legal work, a political speech or one delivered in judicial proceedings, or publications or broadcasts of news of the day, though the author of a political speech retains the exclusive right to publish a collection of such speeches.