South Sudan’s Cybercrime and Computer Misuse Act 2026, signed into law by President Salva Kiir on February 18, 2026, establishes a rigorous legal framework for digital activities, placing significant obligations on service providers and outlining extensive protocols for international cooperation.
Radio Tamazuj’s analysis of Chapters II and III of the Act focuses on real-time data collection, legal assistance between nations, and the specific duties of those operating digital infrastructure.
Service Provider Obligations and Real-Time Data
The Act empowers the national Investigatory Unit to compel service providers to assist in criminal investigations through the collection of both traffic and content data.
- Real-time traffic data: If the Investigatory Unit has reasonable grounds to believe traffic data is relevant to an investigation, it may apply for a court order to collect or record this data in real time within South Sudanese territory.
- Interception of content data: Similar to traffic data, the Investigatory Unit can seek a court order to intercept or record content data in real time.
- Compelled assistance: Service providers are legally required, within their technical capabilities, to effect these collections or recordings and to assist the Investigatory Unit in doing so.
- Confidentiality: Service providers can be compelled by the court to keep the execution of these powers, and any information related to them, strictly confidential.
International Cooperation and Mutual Assistance
Chapter III of the Act focuses on how South Sudan will interact with foreign states regarding cyber-related evidence and investigations.
- General principles: The Authority is mandated to cooperate with foreign states to the widest extent possible for investigations or proceedings concerning criminal offences related to computer systems and data.
- Mutual assistance for content interception: A foreign state may request South Sudanese authorities to provide assistance in the real-time collection or recording of content data for specified communications transmitted via computer systems.
- Request requirements: Any such international request must specify:
- The authority seeking the use of these powers.
- The specific offence under investigation, including a summary of relevant facts.
- The name of the authority that will have access to the intercepted communication.
- The intended duration and the legal reasons for the interception.
- Execution of requests: Upon receiving a valid request, South Sudanese authorities must take appropriate measures to obtain necessary judicial authorisations to execute the request in accordance with domestic law.
Expedited Preservation of Data
The Act also allows for the fast-tracked preservation of digital evidence, especially when there is a risk that data may be modified or deleted.
- Preservation orders: The Investigatory Unit can issue a notice to a person in possession of traffic data, requiring them to preserve the data and its integrity for up to 90 days.
- Partial disclosure: The Unit may also require the disclosure of enough traffic data to identify service providers and the path through which a communication was transmitted.
Production and Search Powers
Authorities are granted specific powers to compel the production of data and to conduct digital searches.
- Production orders: A court may order a person in South Sudan to submit specified data in their possession or control, or order a service provider to submit subscriber information.
- Search and seizure: With a warrant, the Investigatory Unit may enter premises to search for and seize stored data relevant to an investigation. This includes the power to seize computer systems, make copies of data, and maintain the integrity of relevant stored information.