Loi n° 2018-026 du 7 décembre 2018 sur la cybersécurité et la lutte contre la cybercriminalité (Law on Cybersecurity and Combating Cybercrime) (Togo)

Togo's Law No. 2018-026 of 7 December 2018 on cybersecurity and combating cybercrime is the country's principal instrument addressing both cybersecurity governance and cybercrime. Published in the Journal Officiel on 7 December 2018, it establishes the legal and institutional framework for preventing and responding to digital threats and risks, while defining and punishing offences linked to the use of information and communication technologies. On cybersecurity, the law sets out obligations for the protection of information systems and critical infrastructure and provides the basis for Togo's national cybersecurity institutions, including the national cybersecurity agency (ANCy) and the national CERT (CERT.tg), supported by subsidiary instruments such as the 2022 order adopting national cybersecurity rules. On cybercrime, the law criminalises offences against the confidentiality, integrity and availability of computer systems and data, illegal access, illegal interception, data and system interference, and misuse of devices, together with computer-related forgery and fraud and content offences. It equips investigators and prosecutors with procedural powers for the collection and preservation of electronic evidence, including search and seizure of computer data and interception, and addresses international cooperation. As with comparable laws in the region, some content provisions have raised concerns about their potential application to online expression. Digital-rights dimension (June 2026 sweep): Togo is central to West African digital-rights jurisprudence because of its internet shutdowns. During anti-government protests in September 2017 (5-10 and 19-21 September), the government cut internet and messaging access; in Amnesty International Togo and others v Togolese Republic (judgment of 25 June 2020), the ECOWAS Community Court of Justice held the shutdown unlawful and a violation of the right to freedom of expression, the first ECOWAS ruling to confirm that internet shutdowns are unlawful, ordering Togo to compensate the applicants and to guarantee safeguards for freedom of expression (recorded in ATLPF's Cases database). Further connectivity disruptions were reported around the 2020 presidential election. The 2017 shutdowns were ordered without a clearly disclosed digital-rights-specific legal basis and are noted as a jurisdiction-level gap that may belong under Telecoms. In addition, the content offences in this Law (and in subsequent press/communications measures) have raised concerns about their use against journalists and online expression. The 2018 law has been the subject of a subsequent modification process: a bill to amend Law No. 2018-026 was tabled before the National Assembly in 2022; reviewers should confirm the status and content of any enacted amendment. The cybercrime law operates alongside Togo's data protection statute, Law No. 2019-014 of 29 October 2019, and the data protection authority (IPDCP). Source language: French.

1. 1Togo's principal cybersecurity and cybercrime statute, published 7 December 2018
2. 2Substantive offences against confidentiality, integrity and availability of systems and data: illegal access, illegal interception, data and system interference, misuse of devices, computer-related forgery and fraud, and content offences
3. 3Establishes the framework for national cybersecurity institutions, including the national cybersecurity agency (ANCy) and CERT.tg
4. 4Procedural powers for the collection and preservation of electronic evidence, including search and seizure of computer data and interception, plus international cooperation
5. 5Digital-rights significance: Togo's September 2017 protest-era internet shutdowns were held unlawful by the ECOWAS Court in Amnesty International Togo v Togolese Republic (25 June 2020), the first ECOWAS ruling that internet shutdowns violate freedom of expression (recorded in the Cases database); further disruptions reported around the 2020 election
6. 6The 2017 shutdowns were ordered without a disclosed digital-rights-specific legal basis (jurisdiction-level gap, possibly Telecoms); content offences raise online-expression concerns
7. 7A bill to amend Law No. 2018-026 was tabled in 2022, reviewer to confirm the status of any enacted amendment
8. 8Operates alongside Togo's data protection law (Law No. 2019-014 of 29 October 2019) and the IPDCP