Sierra Leone is a member state of the Economic Community of West African StatesThe 3 researched instruments of the Economic Community of West African States are listed on the Economic Community of West African States page, not here. Whether each is in force in Sierra Leone is not yet researched. The law of Sierra Leone, described on this page below, applies here.
9 of 13 named instruments researched to a stage, across three of the ten areas of law we track: 9 in force. As of .
in forcenot yet in forceblocked by a courtproposedno longer in force
Privacy law4 instruments, 4 in force
Research summary (345 words)
Sierra Leone has no comprehensive data-protection statute or dedicated data-protection supervisory authority. The government concluded national validation of a Data Protection and Right to Access Information Bill, 2025 in November 2025, and Cabinet approved a National Data Protection Policy and authorised drafting of the resulting Act into law on , but that Act had not been tabled in or passed by Parliament as of September 2026.
The Electronic Transactions Act, 2018 defines personal information broadly and requires a supplier concluding an electronic contract with a consumer to disclose its security procedures and privacy policy regarding payment information and personal information, and separately lists privacy of communications among a consumer's rights, but it sets no lawful-basis, purpose-limitation, or data-subject-rights regime governing personal-data processing generally.
The Cyber Security and Crime Act, 2021 imposes confidentiality duties tied to criminal-investigation procedure, such as keeping a warrant or interception order confidential, and criminalises a service provider's fraudulent misuse of a consumer's security codes, but does not create a general personal-data-protection duty on private data controllers outside those contexts.
Sierra Leone is a member of the Economic Community of West African States, whose Supplementary Act A/SA.1/01/10 on Personal Data Protection (2010) sets a regional standard; the only located host for that text presented a CAPTCHA challenge, so its domestic status in Sierra Leone could not be confirmed here.
Section 155(3)(h) of the National Communications Authority Act 2022 requires that personal data not be transferred outside Sierra Leone unless there is adequate proof of adequate data protection laws by the recipient jurisdiction. Regulation 22(3) of the Telecommunications (Subscribers Identification and Registration) Regulations 2020 bars transferring subscribers registration information outside Sierra Leone without the Commission's prior approval.
Regulation 22(5) of the Telecommunications (Subscribers Identification and Registration) Regulations 2020 requires service providers to notify the Commission immediately where a subscriber's information is deliberately or otherwise disclosed in violation of the Regulations.
Section 190(1) of the National Communications Authority Act 2022 makes unauthorised collection, storage, use or transmission of subscriber information or such personal records by a communications entity or licensee an offence.
Regulation 22(5) of the Telecommunications (Subscribers Identification and Registration) Regulations 2020 requires service providers to notify the Commission immediately where a subscriber's information is deliberately or otherwise disclosed in violation of the Regulations. Regulation 22(6) of those Regulations requires the Commission, on receiving that notification, to take reasonable steps to minimise the effect of the breach.
Section 155(3)(h) of the National Communications Authority Act 2022 requires that personal data not be transferred outside Sierra Leone unless there is adequate proof of adequate data protection laws by the recipient jurisdiction. Section 155(3) of that Act applies to any person or business that is involved in the collection, storing or processing of personal data. The National Communications Authority Act 2022 commenced on .
Regulation 22(3) of the Telecommunications (Subscribers Identification and Registration) Regulations 2020 bars transferring subscribers registration information outside Sierra Leone without the Commission's prior approval. Regulation 22(4) of those Regulations requires any request for approval to transfer or use customer registration information outside the country to include a justification of the purpose for which the data are required to be transferred.
Section 190(1) of the National Communications Authority Act 2022 makes unauthorised collection, storage, use or transmission of subscriber information or such personal records by a communications entity or licensee an offence. A conviction under section 190(1) carries a fine of not less than 50 million Leones or imprisonment of not less than 3 years, or both. The National Communications Authority Act 2022 commenced on .
Sierra Leone has no scraping-specific statute, so general law governs each dimension separately.
The Cyber Security and Crime Act, 2021 criminalises causing a computer system to perform a function, intentionally and without authorisation, with intent to secure access to a computer system, and defines unauthorised access as either having no entitlement to access at all or exceeding the level of authorisation the person entitled to grant it has consented to, without requiring that a technical security measure be defeated; no reported case has tested whether reading a public, unauthenticated page falls within that definition.
No Sierra Leonean decision addresses the enforceability of a browsewrap or clickwrap terms-of-service against a scraper.
The Copyright Act, 2011 (Act No. 8 of 2011) is Sierra Leone's general copyright statute, but its fair-dealing, quotation, and text-and-data-mining provisions could not be confirmed from primary text: both located electronic copies of the Act (WIPO Lex and a legislative archive mirror) extract as corrupted, unreadable text because of a font-encoding fault in the underlying PDF, so no finding is made on Sierra Leone's copyright or database-right posture toward scraping.
Sierra Leone has no comprehensive data-protection statute, so scraping personal data from a public Sierra Leonean website is not subject to a general lawful-basis or purpose-limitation duty; a Data Protection and Right to Access Information Bill remained pending before Parliament as of April 2026.
No Sierra Leonean statute or reported case establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine, or assigns legal weight to a robots.txt directive or an AI-training-specific rule.
Section 33(1) prohibits intentionally and without authorisation causing a computer system to perform a function with intent to secure access to the whole or a part of a computer system or to enable such access to be secured.
Section 33(3) defines unauthorised, for the purposes of this section, by reference to a person who has been authorised to access specific data and, without lawful excuse, causes the system to perform a function other than what was authorised, and section 33(4) confirms that the absence of authority includes a case where general authority exists but a specific type, nature, or method of access does not.
The Act's general interpretation section separately defines unauthorised access as access by a person who is either not entitled to access the computer system, program, or data at all, or who does not have or exceeds the level of authorisation consented to by the person entitled to grant it. Neither definition requires infringing a technical security measure to gain access, though both turn on there being a scope of consented access to exceed.
On conviction, an individual faces a fine of not less than Le 100,000,000 and not more than Le 250,000,000, or imprisonment of not less than 2 years and not exceeding 5 years, or both, and a corporation, partnership, or association faces a fine of not less than Le 500,000,000 and not exceeding Le 1,000,000,000.
Sierra Leone's Cyber Security and Crime Act, 2021 (Act No. 7 of 2021), the same statute already documented in this jurisdiction's scraping-topic file for its unauthorised-access offence, also carries two operator-facing security duties.
Section 53 requires any person or institution operating a computer system or network, public or private, to report a disruptive attack or intrusion to the National Computer Security Incidence Response Team within 7 days, with its own offence and penalty for failing to do so.
Sections 7 and 8 let the President, on the Minister's recommendation, designate specific computer systems, data, or traffic data as Critical National Information Infrastructure and impose minimum security standards and an audit and inspection regime on whatever is designated, though the Act states no penalty for an operator's non-compliance with that regime.
No instrument sets security requirements a software product or connected device must meet before being placed on the Sierra Leonean market, and no general reasonable-security baseline statute reaches a business simply because it holds covered information; the Electronic Transactions Act, 2018 duty to disclose security procedures to a consumer, documented in this jurisdiction's privacy-topic file, is a transparency duty rather than a security standard.
Sierra Leone has no comprehensive data-protection statute or breach-notification duty; that absence, and the unconfirmed domestic status of the ECOWAS Supplementary Act on Personal Data Protection, is recorded in this jurisdiction's privacy-topic file rather than repeated here.
The Bank of Sierra Leone Cyber Security and IT Risk Management Guidelines for Commercial Banks, published in the Sierra Leone Gazette of , require every commercial bank licensed by the Bank of Sierra Leone to comply with them. Section 9.0 of the Bank of Sierra Leone Cyber Security and IT Risk Management Guidelines for Commercial Banks requires a commercial bank to inform the Bank of Sierra Leone within 24 hours of any cyber security incident.
archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2022. Publisher's page: https://bsl.gov.sl/Cyber%20Security.pdf
In force since .Binds private bodies.
What this law does
The Guidelines require all commercial banks licensed by the Bank of Sierra Leone to comply with them. The Guidelines are developed in accordance with section 53(1) of the Banking Act 2019, which empowers the Bank of Sierra Leone to issue directives and guidelines. Noncompliance with the Guidelines attracts the appropriate penalties and sanctions from the Bank of Sierra Leone. Section 1.7 gives commercial banks 180 days from the effective date of the Guidelines to comply.
Section 5.0 requires commercial banks to continuously monitor the network and information systems to detect anomalies and potential cyber security incidents. The Guidelines come into effect on the day they are published in the Gazette. The Sierra Leone Gazette (Extraordinary) that publishes the Guidelines is dated Friday, .
Section 7(1) lets the Minister, in consultation with the National Cybersecurity Advisory Council, recommend that the President designate specific computer systems, computer data, or traffic data, or a combination of them, as Critical National Information Infrastructure by an Order published in the Gazette.
The Act's interpretation section defines Critical National Information Infrastructure as computer systems necessary for the continuous delivery of essential services Sierra Leone relies on, whose loss or compromise would have a debilitating impact including on services directly related to communications infrastructure, banking and financial services, public utilities, public transportation, or public-key infrastructure.
Under section 7(2), a Presidential Order made under section 7(1) must prescribe minimum standards, guidelines, rules, or procedures including requiring critical information systems to be secured by default and to log system and user activity for accurate and efficient audits.
Section 8 lets a Presidential Order made under section 7(1) require the National Computer Security Incidence Response Team to audit and inspect any Critical National Information Infrastructure at any time to ensure compliance with the Act. Section 2 establishes that body as the National Computer Security Incidence Response Coordination Centre, headed by the National Cyber Security Coordinator.
archived copyRead from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2022. Publisher's page: https://bsl.gov.sl/Cyber%20Security.pdf
In force since .Binds private bodies.
What this law does
Section 9.0 requires commercial banks to inform the Bank of Sierra Leone within 24 hours of any cyber security incident in the format set out as Appendix II. Section 9.0 requires commercial banks to provide the Bank of Sierra Leone each quarter a report in the format of Appendix III concerning occurrences and the handling of cyber security incidents.
Section 7.0 requires commercial banks to promptly report all impending and challenging cyber-threats to their information assets to the Director of the Banking Supervision Department. Section 2.1 makes the Board responsible for reporting in a timely manner to the Bank of Sierra Leone any serious incident relating to information systems or any unexpected event.
Section 53(1) requires a person or institution that operates a computer system or network, whether public or private, to immediately inform the National Computer Security Incidence Response Team of an attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network. Under section 53(2), the Team may propose isolating an affected computer system or network pending resolution of the issue.
Section 53(3) separately makes it an offence to intentionally or without reasonable excuse fail to report such an incident to the Team within 7 days of its occurrence, distinct from any liability for the underlying disruption itself.
On conviction an individual faces a fine of not less than Le 10,000,000 and not more than Le 30,000,000, or imprisonment of not less than 1 year and not exceeding 3 years, or both, and a corporation, partnership, or association faces a fine of not less than Le 50,000,000 and not exceeding Le 100,000,000.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
AI law
Sierra Leone has no AI-transparency, AI-risk, or other AI-specific statute. The Ministry of Communication, Technology and Innovation has been developing the country's first National Artificial Intelligence Strategy, with World Bank Group support, and produced a draft AI Readiness Diagnostic Report, but as of mid-2026 this remained a policy and planning initiative rather than enacted legislation.
The Cyber Security and Crime Act, 2021 and the Copyright Act, 2011 address computer misuse and copyright generally and are researched under the scraping topic; neither imposes an AI-transparency, output-labelling, or bot-disclosure duty.
As of .
Age gating law
Sierra Leone has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code.
The Cyber Security and Crime Act, 2021 criminalises, at section 47, distributing, producing, transmitting, or otherwise making available child pornography through a computer system, and separately criminalises posing, grooming, or soliciting a child for sexual activity through a computer system or network; both are content and conduct offences enforced against the offender, and neither imposes an age-verification or age-gating duty on a service provider.
The Child Rights Act, 2007 (Act No. 7 of 2007), Sierra Leone's general child-welfare statute establishing the National Commission for Children and setting rules on parental duty, labour, marriage, and child protection, contains no reference to the internet, an online service, or electronic communication.
As of .
Reuse law
Sierra Leone's general copyright statute is the Copyright Act, 2011 (Act No. 8 of 2011), signed and published in the Official Gazette on , but its fair-dealing, quotation, and text-and-data-mining provisions could not be confirmed from primary text.
Every located electronic copy of the Act, including the official text held by WIPO Lex and a mirror on a Sierra Leone legislative archive site, extracts as corrupted, unreadable text because of a font-encoding fault in the underlying PDF, so no verified finding can be made on whether the Act contains a press-publisher neighbouring right, a headline or short-extract exception reaching a news aggregator, or a machine-readable text-and-data-mining reservation.
No mandatory platform-to-publisher bargaining code, of the kind Australia's News Media Bargaining Code or Canada's Online News Act creates, and no hot-news or misappropriation doctrine distinct from copyright law, was located for Sierra Leone. No statute or case law addressing whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer, was located either.
As of .
Case law
No current case law for Sierra Leone AI law
No current case law for Sierra Leone privacy law
No current case law for Sierra Leone scraping law
No current case law for Sierra Leone cybersecurity law
No current case law for Sierra Leone communications law
No current case law for Sierra Leone content moderation law
No current case law for Sierra Leone product and AI liability law
No current case law for Sierra Leone digital accessibility law
No current case law for Sierra Leone age gating law
No current case law for Sierra Leone reuse law
Reporting clocks that run here3 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Sierra Leone comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Inform the Bank of Sierra Leone within 24 hours of any cyber security incident, in the format set out in Appendix II to the Guidelines (sec. 9.0(4)).
Promptly report all impending and challenging cyber-threats to your information assets to the Director, Banking Supervision Department, Bank of Sierra Leone (sec. 7.0).
Immediately inform the National Computer Security Incidence Response Team of an attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
Report the incident to the Team within 7 days of its occurrence even if you already gave the immediate notice section 53(1) requires; failing to do so, without reasonable excuse, is itself an offence distinct from any liability for the disruption reported.
Notify the Commission immediately where a subscriber's information is deliberately or otherwise disclosed in violation of the Regulations.
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
