Senegal’s parliament unanimously passes critical infrastructure cybersecurity law 🇸🇳 🛡️

Cliquez ici pour lire en français

On Thursday, August 20, 2026, Senegal’s National Assembly unanimously passed Law n°25/2026 on the protection of critical information infrastructure and digital security — a bill first presented a week earlier, on August 13, 2026, by the Ministry of Telecommunications and the Digital Economy. Framed as a major piece of the country’s digital sovereignty policy, the law comes as government, business, and a growing number of essential services now depend on digital infrastructure.

A security framework scaled to risk 🛡️

To address these threats, the law lays out a broad, progressive legal framework. The goal is to match security obligations to how critical a given system actually is. Ordinary networks and information systems would fall under a common security baseline, while infrastructure classified as critical would face tighter oversight and stricter requirements.

The law specifically requires identifying and registering critical information infrastructure, along with mandatory risk assessments. It also covers data backup, encryption of sensitive information, business continuity, and disaster recovery. Regular resilience testing is meant to check whether these systems can withstand cyberattacks and keep functioning through a disruption.

A new national cybersecurity architecture 💻

The law also strengthens the national organization responsible for preventing and managing cyberthreats. Senegal plans to rely on a National Cybersecurity Authority, along with dedicated Cybersecurity Operations Services. This setup is meant to improve system monitoring, threat detection, and incident response.

New requirements would also cover security incident notification and vulnerability disclosure. The law calls for local hosting of public-sector data and puts guardrails around outsourcing digital services. The goal: tighter control over each link in the digital chain, and a faster national response whenever a threat is detected.

Cybersecurity as an economic opportunity 🚀

Beyond protecting infrastructure, the law carries an economic dimension. Tighter compliance and cybersecurity requirements could help structure the domestic market further.

The text aims to support the growth of Senegalese cybersecurity companies and startups. It also plans to back licensed service providers, create skilled jobs, and help national champions emerge in this strategic sector.

The broader goal is for Senegal to gradually build local skills and solutions to meet its own digital security needs.

What changes for citizens 🔐

For citizens, the stated ambitions include better protection of personal data and continuity of essential services. The law also aims to strengthen the security of connected devices and, more broadly, trust in digital services. The idea is to let people benefit from digital services while reducing the risks tied to cyberattacks and security vulnerabilities.

For the state, this push is also meant to strengthen digital sovereignty and resilience. Protecting strategic infrastructure, hosting public data within national territory, and building up detection and response capabilities against cyberthreats are among the law’s main priorities.

Do you think Senegal is sufficiently prepared to face cyberattacks that could target its critical infrastructure? Let us know in the comments.