Digital Rights at a glance
South Sudan’s current digital rights framework offers minimal legal protection. The country does not adhere to any international convention on digital rights and its first cybercrime law took effect in 2026 with broad speech-related offences and no data protection law in force to counterbalance it. This gap leaves citizens’ personal data unprotected and is the most urgent digital rights concern in view of national elections due in December 2026.
Key commitments
Malabo Convention đź”´
South Sudan neither signed nor ratified the Malabo Convention.
Budapest Convention đź”´
South Sudan is not a party to the Budapest Convention.
Data protection law
South Sudan does not currently have a national data protection law, and privacy protections are scattered across legal texts. The government announced in December 2025 a first-ever Data Protection Bill to be introduced in 2026. Civil society has since taken this further: a full draft bill aligned to the Malabo Convention, the Budapest Convention and Convention 108+, and developed through several rounds of legislative drafting with digital rights organisations — has been handed over to the National Communications Authority (NCA). The bill has not yet been tabled in the Transitional National Legislative Assembly or passed into law, and there is still no independent data protection authority, no defined legal basis for processing personal data, and no rules on cross-border data transfers.
Existence of an independant Data Protection Authority đź”´
No existing data protection authority
Cybercrime law
The Cybercrimes and Computer Misuse Act, 2026 was signed by President Salva Kiir on 18 February 2026 (replacing the 2021 Provisional Order) and enforced since July 2026. Provisions targeting hacking, fraud and identity theft fill a genuine gap. But the law moved well ahead of any corresponding data protection or free-expression safeguards: broadly worded offences on “false or misleading information” and “undesirable content” carry criminal penalties with no public-interest or journalism exemptions criticised as enabling the criminalisation of journalism and dissent. Up to five years of imprisonment are imposed for loosely defined “cyber harassment”, and the National Communications Authority is granted power to compel internet service providers to hand over user data, with no independent oversight body to check how any of these powers are applied.
State of play
South Sudan’s digital governance is still at a foundation-building stage, and the legislative and institutional tracks are moving at very different speeds. The adoption of the Cybercrimes and Computer Misuse Act, 2026 shows the state is now willing to legislate on digital conduct although with significant flaws concerning rights protection. With national elections scheduled for December 2026, the gap between the cybercrime law that is enforceable now and the data protection law, which still has to clear the Transitional National Legislative Assembly means legitimate online expression, journalism and election-related speech carry legal risk and user privacy is not protected.
Capacity and infrastructure are now the binding constraint, not political will alone. The ICT minister has himself acknowledged that parliament, judges and police need training on handling digital evidence, and Digital Watch Observatory notes South Sudan ranked 192nd of 193 countries in the UN’s 2024 E-Government Development Index. A proxy for how thin institutional digital capacity is across government generally, not just on rights enforcement. Indeed the National Communications Authority, which the cybercrime law makes the lead regulator, has no track record regulating data protection and the judiciary has limited experience adjudicating digital-evidence or privacy cases.
South Sudan has also not signed or ratified neither of the two main continental and international frameworks (the Malabo Convention and the Budapest Convention) that could otherwise anchor its reforms and bring technical and capacity-building support in established standards.
Recommendations
1. Table the Data Protection Bill in the Transitional National Legislative Assembly immediately and establish an independent data protection authority, to have a functioning data protection regime before the December 2026 elections.
2. Amend the Cybercrimes and Computer Misuse Act, 2026 to narrow the “false or misleading information” and “undesirable content” provisions, add public-interest and whistleblower exemptions, and remove criminal penalties for defamation.
3. Accede to the Malabo Convention and the Budapest Convention to anchor domestic cybersecurity and data protection reforms in continental and international standards and unlock related technical support.
4. Invest in institutional capacity: structured training for parliamentarians, judges, prosecutors, police, and Nation Communications Authority staff on digital evidence, data protection principles, and rights-respecting enforcement, so that the new legal framework does not outpace the institutions meant to apply it fairly.
Partners of Digitalise Youth who contributed to this section:
Digital Rights Frontline, South Sudan
