Nauru's general communications statute is the only instrument reaching a private-sector duty-bearer's information handling, and on inspection it does not cross the seam into this topic.
The Communications and Broadcasting Act 2018 (No. 21 of 2018) binds a licensed communications service provider under Part 8: section 48(1) bars disclosing a subscriber's information without the subscriber's written consent, and section 49(1) separately requires the provider to take all reasonable steps to maintain the confidentiality of subscriber communications.
Unlike Liberia's Telecommunications Act 2007 section 51(5), which protects customer information and communications with security safeguards appropriate to their sensitivity, or Solomon Islands' Telecommunications Act 2009 section 72(1)(b), which requires appropriate security safeguards to prevent the collection, use, maintenance or disclosure of consumer information, Nauru's Act nowhere uses security or safeguards language in connection with subscriber information or communications; section 49(1)'s duty to take reasonable steps to maintain confidentiality is a non-disclosure-shaped confidentiality obligation continuous with section 48's consent duty and section 70's confidentiality-and-offence scheme, not a codified information-security-programme or safeguards requirement of the kind that crosses to this topic even when personal data is its trigger.
It stays on the personal-data side of the seam rather than on the system's-security-posture side.
This jurisdiction's own privacy-topic row already researches and pins this exact clause as part of one comprehensive instrument covering consent, correction, retention and confidentiality; filing the same clause here a second time, under this topic, would duplicate a single duty across two topics for no reader benefit, the exact failure this topic's own seam determination records from an earlier research wave that filed a comprehensive regime's safeguards article under both topics before the rule was written down.
Section 70 of the same Act makes it an offence, on conviction punishable by a fine not exceeding $10,000 or imprisonment not exceeding two years or both, for a person other than the Authority's staff, a service provider, or its employee, agent or contractor acting lawfully in the course of duty to intentionally intercept, use or disclose a subscriber's communications or information; section 71 similarly criminalises intentional, unlawful interference with or modification of a communication's contents by such a person acting outside the proper course of duty.
Both bind a person who attacks the confidentiality of a communication rather than imposing a duty on the operator's own security posture, so they belong with the scraping topic's computer-misuse family and not here.
Part 17 of the Act (sections 106 to 108) requires a service provider to comply with a Presidential request for access to its network or services in connection with national security requirements or prevention or prosecution of contravention of any laws of the Republic, a state-access duty running toward the government's own investigative and emergency powers, not a duty on the provider's security posture toward its own systems or its users.
The Cybercrime Act 2015 (No. 14 of 2015) is a pure computer-misuse statute: Part 2's illegal-access, illegal-interception and data-interference offences (sections 6 through 10) bind the person who attacks a computer system, including an aggravated offence at section 10(c), punishable by up to 7 years' imprisonment, for conduct affecting critical infrastructure operations, a term defined only as this aggravating factor and never as the basis of an operator-facing resilience duty.
The Act's remaining provisions are criminal-investigation procedure: an internet service provider's duty to keep confidential the fact of a court order under investigation (section 19), duties to produce subscriber information or preserve data on police or judicial application (sections 26 and 27), and duties under sections 20 and 25 to permit and assist a police officer executing a search, seizure or interception order, all directed at cooperating with an ongoing investigation rather than at the provider's own security posture or a reporting duty running to an authority or to users.
No provision of either Act sets a security requirement a software product or connected device must meet before or after being placed on a market, no vulnerability-handling or coordinated-disclosure duty, no incident-reporting clock, and no general reasonable-security or information-security-programme baseline reaching a business with no sector gate. The Copyright Act 2019 carries no security-relevant provision.
Nauru has no comprehensive data-protection or privacy statute and no dedicated data-protection supervisory authority, a gap this jurisdiction's own privacy-topic research already records, so there is no comprehensive regime whose own security-of-processing article could sit on the other side of this seam.
Whether the Nauru Communications Authority, any Nauru financial regulator, or the Nauru Utilities Corporation has issued a cybersecurity or information-technology risk directive for its licensees is not confirmed here: the Republic's public government portal (nauru.gov.nr) rendered as a JavaScript shell of under 2,000 characters under both the compliant and stealth crawler tiers, named no such regulator or directive, and this session's web-search tool was unavailable to search further, so that question remains an open research gap rather than a settled absence.
