Yemen: AI, privacy and software law

Cybersecurity law1 instrument, 1 in force

Research summary (424 words)

Yemen's one located private-sector security duty sits inside Law No. 40 of 2006 Regarding Electronic Payment Systems and Financial and Banking Operations, a banking-sector statute rather than a dedicated cybersecurity or product-security act.

Article 27 binds every financial institution practicing electronic funds transfer under the Law to comply with the Central Bank of Yemen's Bank Law and Banks Law and, separately, to take the measures necessary to provide secure services to customers and preserve banking confidentiality; no located provision of the Law attaches a named penalty to a breach of that specific duty, and Chapter Eight's penalties (Articles 37 to 41) instead punish fraud in obtaining or issuing an authentication certificate, false information supplied to a document-authentication provider, and a licensed authentication provider's own registration or confidentiality violations, offenses this jurisdiction's scraping-topic finding already covers.

Article 44 directs the Governor of the Central Bank of Yemen to issue instructions establishing the infrastructure for payment systems, organizing authentication-certificate issuance with safeguards for the confidentiality of an electronic-signature code, and setting the technical specifications and conditions required of devices and machines used in financial and banking technology, but no implementing regulation exercising that power was located, so no checkable product-security requirement currently exists on the record.

No vulnerability or incident reporting duty running to an authority or to users was located anywhere in Yemeni law. No general, non-sector-gated reasonable-security statute reaching an ordinary data-holding business was located either; the Penal Code, Law No. 12 of 1994, contains no provision addressing a computer system, consistent with this jurisdiction's scraping-topic research.

The Central Bank of Yemen is the regulator named throughout Law No. 40 of 2006 as the issuer of binding instructions for electronic banking, but no published enforcement action against a bank or financial institution for breach of Article 27's security duty was located.

Yemen has no comprehensive data-protection statute and no breach-notification duty in the privacy-topic corpus; Articles 52 and 53 of the Constitution supply general privacy rights with no processing regime of their own, so there is no privacy-topic row to name as this jurisdiction's counterpart to Article 27's safeguards duty.

WIPO Lex carries no Yemen jurisdiction browsing page at its standard legislation/profile address, and ILO NATLEX and the ITU each return no Yemen country page at their standard address either; UNCTAD's Global Cyberlaw Tracker page sits behind a Cloudflare bot challenge that blocks every request, so its own tracked status for Yemen is not described here. Yemen's National Information Center government portal is reachable and current but surfaces no laws repository from its homepage.

Sector security regimes

Law No. 40 of 2006 on Electronic Payment Systems and Financial and Banking Operations, Secure-Services and Banking-Confidentiality Duty

Law No. 40 of 2006 Regarding Electronic Payment Systems and Financial and Banking Operations, art. 27Official Arabic-language PDF of Law No. 40 of 2006 Regarding Electronic Payment Systems and Financial and Banking Operations

In force since 28 Dec 2006. Binds private bodies.

What this law does

Article 27 of Law No. 40 of 2006 Regarding Electronic Payment Systems and Financial and Banking Operations binds every financial institution practicing electronic funds transfer under the Law to two duties: comply with the Bank Law, the Banks Law, and the related laws, regulations, and instructions issued under them, and take the measures necessary to provide secure services to customers and preserve banking confidentiality.

The Law defines a financial institution as any body authorized to deal in financial transfers under the laws in force, a class that reaches a payments or funds-transfer platform operating as, or through, a licensed Yemeni financial institution.

Article 30 separately empowers the Central Bank of Yemen to issue the instructions needed to organize electronic funds transfer business, including approving electronic payment methods and the disclosure of information banks and financial institutions must provide; Article 44 further directs the Bank's Governor to establish payment-system infrastructure, organize authentication-certificate issuance with confidentiality safeguards for an electronic-signature code, and set technical specifications for devices and machines used in financial and banking technology, but no implementing regulation issued under either article was located, so no specific technical standard is described here.

No provision of this Law's Chapter Eight (Articles 37 to 41) names a penalty for a breach of Article 27 itself; that chapter's penalties instead attach to authentication-certificate fraud and a licensed authentication provider's own violations, and are this jurisdiction's scraping-topic computer-misuse and fraud findings rather than a security-topic one.

What it requires

Reuse law1 instrument, 1 in force

Research summary (228 words)

Yemen has no press-publisher neighbouring right, no compelled platform-to-publisher bargaining code, no recognized hot-news misappropriation doctrine distinct from ordinary copyright law, and no located statute or case law addressing hyperlinking or framing liability.

The operative instrument is Law No. 15 of 2012 on the Protection of Copyright and Related Rights: article 5(3) excludes the news of incidents or events that is merely media descriptive material from copyright protection outright, so a bare news item or fact is never a protected work regardless of who first reported it.

Article 40(3) lets any person quote items or excerpts from another work for clarification, explanation, or critique with attribution, and states expressly that the exception reaches items taken from articles and journalist periodicals, and article 41(A) separately lets any person copy or republish a newspaper article, or an article in an economic, political, or religious periodical, with attribution, unless the right to copy or transfer it to the public has been explicitly reserved by the author or right holder, an opt-out condition rather than a blanket permission.

Neither provision is capped at headline length or a short extract, and whether either reaches a systematic news aggregator, as opposed to a traditional press review, has not been tested in a reported Yemeni decision. The Law predates the concept of a machine-readable text-and-data-mining reservation entirely, so no opt-out mechanism of that kind exists.

Where nothing was found4 areas of law

These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.

AI law

Yemen has no AI-specific statute, strategy, or regulation. The Penal Code, Law No. 12 of 1994 on Crimes and Penalties, contains no provision addressing a computer system, automated decision-making, or AI-generated or synthetic content, and does not ban a deepfake or a synthetic likeness. Law No. 13 of 2012 on the Right of Access to Information, a citizen-access statute binding public authorities, likewise does not address artificial intelligence.

As of 6 September 2026.

Privacy law

Yemen has no comprehensive personal-data-protection law; this is a sourced absence. Two constitutional provisions supply general privacy rights, confirmed at primary source (168,190 characters, not truncated): Article 52 (sanctity of homes, places of worship, and educational institutions from surveillance or search) and Article 53 (freedom and confidentiality of mail, telephone, telegram, and other communications).

A citation of Article 52 for communications privacy conflates the two: Article 52 is about home and institutional sanctity, and communications privacy is Article 53. A sectoral Electronic Payment Systems and Financial and Banking Operations Law, No. 40 of 2006, exists per secondary sourcing but is scoped to banking and payment data, not general personal-data processing; its text is not cited here.

A candidate "Electronic Transactions Law No. [2010]" could not be confirmed to exist under that description at all: a search for it surfaced only Law 40/2006 itself and a 2014 circular extending mobile electronic-money services under that same 2006 framework, not a standalone 2010 statute, so it is not authored here and should not be carried forward without independent verification.

As of 29 August 2026.

Scraping law

Yemen has no scraping-specific statute, and each of the eight research dimensions is a sourced absence rather than an unsettled question. The Penal Code, Law No. 12 of 1994 on Crimes and Penalties, contains no provision addressing a computer system or unauthorized access.

Law No. 40 of 2006 on Electronic Payment Systems and Financial and Banking Operations criminalizes fraudulently creating, publishing, or presenting an authentication certificate (art. 38), giving false information to a document-authentication provider (art. 39), and an authentication provider's own violations of its registration or confidentiality duties (art. 40), and separately punishes whoever commits an act constituting a crime under the laws in force by using electronic means (art. 41); article 41 raises the penalty for an act that is already a crime under some other law when it is committed electronically, so it does not independently criminalize accessing or copying data from a public, unauthenticated page, and no reported Yemeni decision applies it to a scraper.

No Yemeni court has ruled on the enforceability of a browsewrap or clickwrap terms of service against a scraper. Law No. 15 of 2012 on the Protection of Copyright and Related Rights protects a database as a copyright work only where it is creative in the selection or sequence of its content, confers no separate sui generis database right, and contains no technological-protection-measure or anti-circumvention provision.

Yemen has no comprehensive personal-data-protection statute; articles 52 and 53 of the Constitution supply general privacy rights with no processing regime of their own, so scraping personal data from a public Yemeni website is not subject to a dedicated lawful-basis or purpose-limitation duty.

No Yemeni statute or reported decision establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.

As of 7 September 2026.

Age gating law

Yemen has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code. The Press and Publications Law No. 25 of 1990 regulates newspapers, printers, and publishers through licensing and content restrictions and contains no provision addressing a minor or age verification.

The Child Rights Law No. 45 of 2002 devotes a chapter to media directed at children (arts. 98 to 102) encouraging beneficial children's programming and content, and separately bars publishing, displaying, or circulating printed matter, posters, or audiovisual material aimed at a child that appeals to base instincts or promotes deviant conduct (art. 95), and bars a cinema or similar public venue from admitting a child to a screening unsuitable for their age unless the venue posts a clear notice of the restriction (art. 96), with criminal penalties in arts. 158 to 159 for violating either provision.

These are content-standards and physical-venue admission duties addressed to publishers and cinemas, not an age-verification or age-gating duty on an online or on-demand service, and the Law contains no provision addressing an internet, telecommunications, or online service.

As of 7 September 2026.

Case law

No current case law for Yemen AI law
No current case law for Yemen privacy law
No current case law for Yemen scraping law
No current case law for Yemen cybersecurity law
No current case law for Yemen communications law
No current case law for Yemen content moderation law
No current case law for Yemen product and AI liability law
No current case law for Yemen digital accessibility law
No current case law for Yemen age gating law
No current case law for Yemen reuse law

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

This page covers the instruments LexLint has researched to a stage. Instruments named in the law library but not yet researched are counted in the head and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.

Yemen