Cybercrime and Computer Misuse Act, 2026

The Cybercrime and Computer Misuse Act 2026 is South Sudan's first comprehensive cybercrime statute. It was passed by the Transitional National Legislative Assembly in November 2025 and signed into law by President Salva Kiir on 18 February 2026, with Chapter I taking effect on signature. The Act has a long and contested history: a version was first introduced by Provisional Order in 2020 and signed during a parliamentary recess in 2021, but was rejected by the Assembly and returned to the executive for redrafting to comply with the Transitional Constitution. The Act is organised into several chapters. Chapter I sets out definitions; Chapters II and III deal with real-time collection of data, mutual legal assistance between states, and the duties of those operating digital infrastructure; Chapter IV confers extensive investigative and prosecutorial powers and establishes a specialised enforcement unit; Chapter V provides for the identification, protection and monitoring of critical national infrastructure; and Chapter VI sets out the substantive offences. The offences combine cyber-dependent and cyber-enabled conduct: unauthorised access and unauthorised data transmission, hacking, espionage, cyberterrorism and economic sabotage, attacks on critical infrastructure, the creation of fake websites and social-media accounts, online impersonation, the publication of false information and indecent content, and a series of conduct offences - cyberstalking (up to four years' imprisonment), cyber harassment (up to five years), offensive communication (up to two years) and cyberbullying (up to ten years). On procedure and institutions, the Act establishes the National Cybercrime Prosecution Unit under the Ministry of Justice and Constitutional Affairs to investigate and prosecute offences; the Unit may seek court orders compelling the production of digital evidence and, under a court-issued warrant, enter premises to search for and seize computer systems and storage media and to copy relevant data. Operationalisation is led by the Ministry responsible for ICT in collaboration with the National Communication Authority, law-enforcement agencies and the Ministry of Justice. The Act has been sharply criticised by press-freedom and human-rights organisations over vague 'false information' and 'undesirable content' provisions.

1. 1South Sudan's first comprehensive cybercrime statute; passed by the TNLA in November 2025 and signed into law on 18 February 2026 (Chapter I effective on signature)
2. 2Cyber-dependent offences: unauthorised access and data transmission, hacking, espionage, cyberterrorism, economic sabotage and attacks on critical national infrastructure
3. 3Cyber-enabled and content offences: fake websites and social-media accounts, online impersonation, publication of false information and indecent content
4. 4Conduct offences: cyberstalking (up to 4 years), cyber harassment (up to 5 years), offensive communication (up to 2 years) and cyberbullying (up to 10 years)
5. 5Procedural powers (Chapters II-IV): real-time data collection, mutual legal assistance, production orders for digital evidence and warrant-based search and seizure
6. 6Establishes the National Cybercrime Prosecution Unit under the Ministry of Justice and Constitutional Affairs; critical-infrastructure regime in Chapter V
7. 7Operationalised by the ICT Ministry with the National Communication Authority, law enforcement and the Ministry of Justice; criticised by press-freedom groups over vague false-information and undesirable-content offences