LexLint

Know the law your code answers to.

Law / Sierra Leone

Cyber Security and Crime Act, 2021, Reporting of Cyber Security Incidents

Cyber Security and Crime Act, 2021 (Act No. 7 of 2021), s. 53 (Reporting Cyber Threats)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 November 2021.

A vulnerability and incident reporting rule binding public and private bodies.

As of 19 September 2026.

What it requires

  • This binds a person or institution that operates a computer system or network, whether public or private, not a licensed or sector-specific status; operating a computer system or network at all is enough to place an app in scope.
  • Immediately inform the National Computer Security Incidence Response Team of an attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
  • Report the incident to the Team within 7 days of its occurrence even if you already gave the immediate notice section 53(1) requires; failing to do so, without reasonable excuse, is itself an offence distinct from any liability for the disruption reported.
  • The Act does not name a reporting channel, form, or contact point for the National Computer Security Incidence Response Team, unlike India's CERT-In directions or similarly detailed regimes; confirm the current reporting channel directly with the Team, housed within the Ministry of Communication, Technology and Innovation.

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

A fine of not less than Le 10,000,000 and not more than Le 30,000,000, or imprisonment of not less than 1 year and not exceeding 3 years, or both, for an individual who intentionally or without reasonable excuse fails to report within 7 days; a corporation, partnership, or association faces a fine of not less than Le 50,000,000 and not exceeding Le 100,000,000 (s. 53(3)).

Penalty structure

Fine stated in the old Sierra Leonean Leone, the currency in circulation when this 2021 Act was passed (Sierra Leone redenominated to a new Leone in 2022). The same subsection also allows imprisonment of not less than 1 year and not exceeding 3 years instead of or in addition to the fine, and sets a separate, higher fixed range of Le 50,000,000 to Le 100,000,000 for a corporation, partnership, or association.

Rule
Fixed only
As of
19 September 2026
Minimum
10,000,000
Currency
SLL
Fixed cap
30,000,000

Who enforces it

Enforcement body

The National Computer Security Incidence Response Team receives the report and takes necessary and appropriate measures to protect computer systems and networks under section 53(1)-(2); a failure to report within 7 days is prosecuted as an ordinary criminal offence under section 53(3), and the Act names no separate civil or administrative enforcement power for the Team itself.

Settledness

As of
19 September 2026
Open questions
Does section 53(1)'s duty to inform the Team "immediately" set any outer time limit shorter than the 7-day window section 53(3) uses to define the reporting offence, or are the two the same clock stated twice?

What it reaches

Obligation class

Reporting, Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 53(1) requires a person or institution that operates a computer system or network, whether public or private, to immediately inform the National Computer Security Incidence Response Team of an attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network. Under section 53(2), the Team may propose isolating an affected computer system or network pending resolution of the issue.

Section 53(3) separately makes it an offence to intentionally or without reasonable excuse fail to report such an incident to the Team within 7 days of its occurrence, distinct from any liability for the underlying disruption itself.

On conviction an individual faces a fine of not less than Le 10,000,000 and not more than Le 30,000,000, or imprisonment of not less than 1 year and not exceeding 3 years, or both, and a corporation, partnership, or association faces a fine of not less than Le 50,000,000 and not exceeding Le 100,000,000.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions
  • processes_voice
  • processes_biometrics
  • serves_minors
  • operates_social_platform
  • ships_mobile_app
  • distributes_software_product
  • handles_health_records
  • provides_financial_services
  • operates_essential_service
  • is_listed_company
  • provides_telecom_services

Read the law

official gazetted Act text, Supplement to the Sierra Leone Gazette No. 71 of 25 November 2021, reproduced by SierraLII (Laws.Africa)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app