Sierra Leone

Sierra Leone has no enacted personal data protection statute. Its first dedicated instrument, the Data Protection and Right to Access Information Bill 2025, has been developed by the Ministry of Information and Civic Education through a multi-stage policy and validation process. A national data protection policy was prepared as a precursor, and in April 2026 Cabinet approved that policy and authorised the Ministry, working with the Attorney-General's office, to finalise the Bill for tabling in Parliament. As of June 2026 the Bill has not been enacted. A notable structural choice is that the Bill would combine data protection and right-to-access-information functions in a single statute, with one unified supervisory authority overseeing both mandates, a model similar to The Gambia's 2025 Act. Cabinet simultaneously authorised repeal of the existing Right to Access Information Commission Act, with the new body absorbing both remits. The Bill is designed to establish data subject rights, controller and processor obligations, and penalties for unauthorised access, unlawful processing, and breach concealment, and explicitly aims to regulate intelligence and security-agency use of personal information within a national-security/privacy balance, while aligning Sierra Leone with international standards for trade and digital cooperation. No data protection authority has yet been established, and no official public draft text has been confirmed on file. Until Parliament enacts the Bill, Sierra Leone has no statutory data protection regime and no supervisory enforcement.