South Sudan’s government has said it will introduce its first-ever Data Protection Bill in 2026, as the country seeks to address the legal challenges of its growing digital economy.
The announcement comes alongside warnings from civil society that the recently passed cybersecurity law contains significant gaps.
Minister announces new legislation
The Minister of Information, Communication Technology and Postal Service, Ateny Wek Ateny, said the data protection law was essential to secure citizens’ personal information.
Speaking at an MTN event in the capital, Juba, on Thursday, he said the bill would complement the new Cybercrime and Abuse of Computer Bill 2025, which has been passed by parliament and is awaiting presidential assent.
“Cybercrime and data protection are two laws that must work together,” Ateny said. “Without a Data Protection Act, it is like you are providing food with no broth.”
He stated that existing laws, such as the Criminal Procedure Act 2008, were outdated in the face of rapid digitalisation, particularly among the young.
“We have a generation that can do without food but cannot do without the internet,” the minister said.
Ateny added that the ministries of information and justice would jointly draft the new law to ensure that by 2026 “we have all the laws that govern cyberspace in place.”
Activists highlight ‘loopholes’
The minister’s announcement follows concerns raised last week by civil society activist Edmund Yakani regarding the newly passed cybercrime bill.
Yakani, while welcoming the introduction of cybercrime legislation, warned it could be ineffective or abused without accompanying reforms and public awareness campaigns.
He told Radio Tamazuj that digital-facilitated gender-based violence was rising sharply, but many law enforcement officers lacked the technical skills to investigate such online crimes.
He cited instances where courts had struggled with complaints involving AI-manipulated images because officials did not understand the technology.
Yakani also cautioned that some security personnel had used coercive digital tactics during investigations, potentially violating rights “without realising such acts constitute crimes.”
He urged lawmakers to integrate digital offences—including cyber harassment and non-consensual image sharing—into broader gender-based violence legislation, noting the current draft Anti-GBV Bill does not cover digital abuse.
He further called for training for parliament, judges and police on handling digital evidence, and for South Sudan to define cybercrimes clearly in line with international standards.
Calls for balanced approach
Minister Ateny emphasised the need for private sector collaboration to build “a more connected, inclusive and digitally empowered nation.”
However, Yakani insisted that user safety, rights and digital literacy must be central to the country’s digital development.
If enacted, the proposed Data Protection Act would align South Sudan with regional frameworks such as Kenya’s Data Protection Act and the African Union’s Malabo Convention on cyber security.