The Lesotho government has convened a two-day consultation on the Cybersecurity Bill 2026, bringing together regulators, financial institutions, law-enforcement agencies, service providers, and other stakeholders to discuss the proposed legislation. The consultation, organised by the Ministry of Information, Communications, Science, Technology and Innovation, the Lesotho Communications Authority, and the United Nations Development Programme, aims to address concerns surrounding the Bill before it proceeds to the next stage of the legislative process.
The Cybersecurity Bill 2026 has faced significant delays, with earlier versions encountering strong objections from stakeholders and ultimately failing to make it through the legislative process. The 2021 version was withdrawn from Parliament and returned to the responsible ministry after Members of Parliament adopted a resolution to send it back for further work. A subsequent version, the Computer Crime and Cyber Security Bill 2024, also faced resistance from media and civil society organisations, who raised concerns about provisions that could undermine freedom of expression, privacy, and other constitutional rights.
The current consultation is intended to strengthen Lesotho's cyber resilience by ensuring that the country's legal framework is fit for purpose. Acting Principal Secretary in the Ministry of Information, Communications, Science, Technology and Innovation, 'Maleloko Nkhahle, said the consultation forms part of the government's ongoing efforts to strengthen Lesotho's national cybersecurity framework. The Bill is the culmination of a process that began with the Computer Crime and Cybersecurity Bill 2024, which initially sought to address cybersecurity governance and cybercrime under a single legislative framework.
The government has already begun implementing aspects of its national cybersecurity agenda despite the absence of the new legislation. One of the measures is the designation of the Lesotho Communications Authority as the agency for the Computer Security Incident Response Team, which is intended to minimise and control damage arising from data breaches, cyberattacks, and other security incidents. The team will also provide guidance on recovery and serve as a central point for reporting security incidents and coordinating responses with legal and management teams.
The National Cybersecurity Forum was launched in July 2026, bringing together representatives from government, the private sector, academia, civil society, and the technical community. The forum is intended to provide a platform for dialogue, information sharing, capacity building, and the development of a cybersecurity culture. The 2026 Bill also introduces a framework for the recognition, registration, and oversight of cybersecurity professionals, promoting professional standards, accountability, and ethical conduct.
The Bill proposes a two-tier regulatory framework, with obligations differentiated according to the nature, size, criticality, and risk profile of regulated entities. This approach aims to prevent unnecessary compliance burdens while ensuring that entities facing greater cybersecurity risks are subject to appropriate safeguards. The government argues that this framework will enable it to effectively regulate and oversee cybersecurity in Lesotho.
The Cybersecurity Bill 2026 will establish institutional structures for managing cybersecurity in Lesotho and regulate the prevention, management, and response to cybersecurity threats and incidents. It will also provide for the identification and declaration of critical information infrastructure, and establish a National Cybersecurity Agency and a National Cybersecurity Committee. Key stakeholders, including the Lesotho Communications Authority, Central Bank, and Lesotho Electricity and Water Authority, will be designated as competent authorities to oversee cybersecurity policies, regulations, and standards within specific sectors.
Key points
- The Lesotho government is consulting stakeholders on the Cybersecurity Bill 2026 to address concerns and provide input on the legislation.
- The Bill aims to strengthen Lesotho's cyber resilience and provide a framework for the recognition, registration, and oversight of cybersecurity professionals.
- The proposed legislation will establish institutional structures for managing cybersecurity in Lesotho and regulate the prevention, management, and response to cybersecurity threats and incidents.
