Law No. 6 of 2022, protection of personal data collected in electronic transactions
Law No. 6 of 2022 Concerning Electronic Transactions, arts. 73-79 (Protection of Personal Data)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 4 October 2022.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Before collecting personal data for issuing, maintaining, or facilitating an authentication certificate, obtain the person's explicit consent, and do not use it for a different purpose without a further explicit consent.
- Keep personal data confidential and do not disclose, transfer, or publish it without the data subject's prior consent.
- Before processing a person's data, give them notice of who is responsible for the processing and the nature, purpose, and method of the processing.
- Let a person access and update the personal data collected about them, through appropriate technological means.
- Before transferring personal data outside Libya, give due consideration to the nature of the data, its source, the purpose and duration of processing, and the destination country's laws and security measures.
- Do not send a person electronic documents, or process their personal data, once they have explicitly refused, and do not use their data for a purpose beyond the one they agreed to.
Who enforces it
Enforcement body
National Authority for Information Security and Safety
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Transfer, Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 73 of Law No. 6 of 2022 requires a public entity or an authentication service provider to obtain a person's explicit consent before collecting their personal data, and confines any collection to the purpose of issuing, maintaining, or facilitating a certificate, absent the person's further explicit consent to a different purpose.
Article 74 lists narrow grounds on which collecting, disclosing, or processing personal data is otherwise lawful, including a criminal investigation, a court order, a tax assessment, or protecting a person's vital interest.
Article 75 binds the authentication service provider to keep personal data confidential and bars disclosing, transferring, or publishing it without the data subject's prior consent, and article 76 requires any person who controls personal data by virtue of their work in electronic transactions to give the data subject notice, before processing, of who is responsible for the processing and the nature, purpose, and method of the processing.
Article 77 requires the authentication service provider to let the person whose data was collected access and update it, including all personal data sites related to them, through appropriate technological means. Article 78 requires due consideration of the nature of the data, its source, the purpose and duration of processing, and the destination country's laws and security measures before personal data is transferred outside Libya.
Article 79 bars sending electronic documents to a person who has explicitly refused them, bars processing personal data against the data subject's explicit refusal, and bars using personal data for a purpose other than the one agreed to without the data subject's consent; article 81's criminal penalties are stated for the offences article 80 lists, and the text does not clearly extend that penalty to article 79's restrictions on personal-data processing.
When LexLint raises it
automated_outreach
Read the law
English translation from The Law Society of Libya (Almajma Legal Directory) legislation database
lawsociety.ly, not an official government-published translation the stored page text carries a leftover assistant sign-off sentence between articles 9 and 10 ('I hope you find this translation helpful. Let me know if you have further questions or need additional clarification.'), indicating the English rendering is AI-assisted rather than an official one