Libya

Decision of the Minister of Economy and Trade requiring a practising permit from the National Authority for Information Security and Safety for seven cybersecurity services, including SOC management, penetration testing and incident response (Art. 2). Commercial registrations are renewed only with a valid permit (Art. 3) and existing practitioners had six months to regularise (Art. 4). It imposes no incident-reporting duty.

House of Representatives law issued on 27 September 2022 and effective from issuance (Art. 53). It criminalises unlawful access, data tampering, card and e-money forgery, content offences, copyright piracy and online money laundering, and makes the National Authority for Information Security and Safety responsible for blocking content and licensing encryption (Arts. 7-9). It contains no data-retention or incident-reporting duty for service providers.

House of Representatives law on electronic signatures, documents, authentication, contracts and payments. It makes the National Authority for Information Security and Safety responsible for licensing certification providers (Arts. 27-30), has personal-data rules in Arts. 73-78 and e-money provisions in Art. 70, and required executive regulations within a year (Art. 86). Dated 4 October 2022 and effective from issuance (Art. 87).