TogoLoi n° 2018-026, opérateurs de services essentiels and the National Cybersecurity Agency (ANCy)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 7 December 2018.
A sector security regimes rule binding public and private bodies.
As of 19 September 2026.
What it requires
- This binds you only where a decree issued under Article 3 designates your organization an opérateur de services essentiels (operator of essential services): a public or private operator whose service is essential to the functioning of society or the economy and whose continuity could be gravely affected by an incident affecting the networks or information systems you need to provide it. No such designating decree is located in the sources reviewed here, so which sectors or operators it would name is not established.
- Once designated, comply with the cybersecurity rules for protecting your essential infrastructure that a decree in Council of Ministers fixes under Article 3, and expect the Agence nationale de la cybersécurité (ANCy) to control, audit and inspect your compliance with them.
- Expect ANCy to condition your accreditation on that compliance, and to impose astreintes or monetary sanctions if you do not comply; the amounts and procedure for both are left to a decree in Council of Ministers not located here.
- Expect ANCy to collect technical information about an incident affecting your essential infrastructure; the Act itself states no notification deadline or threshold of your own for reporting one.
- A separate ANCy certification of hardware, software or IT services for their cybersecurity capability exists under Article 6, but the Act states no duty to hold it before you place a product or service on the market, so it is not raised here as a market-placement requirement.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Who enforces it
Enforcement body
Agence nationale de la cybersécurité (ANCy)
Settledness
No implementing decree under Article 3 or Article 6 is located in the sources reviewed here.
- As of
- 19 September 2026
- Open questions
- Has the decree required by Article 3 to designate operators of essential services and to determine essential infrastructure been issued, and if so, which sectors or operators does it name?
- Does the decree in Council of Ministers required by Article 3 to fix the cybersecurity rules binding on an operator of essential services set a specific incident-notification threshold or clock, given that Article 6(12) empowers ANCy only to collect technical incident information without stating one in the Act itself?
- What amounts or modalities has the decree in Council of Ministers referenced by Article 6 fixed for the astreintes and sanctions available against a non-compliant operator of essential services?
What it reaches
Obligation class
Security, Licensing
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Titre II of Loi n° 2018-026 subjects an operator of essential services to cybersecurity rules that protect its essential infrastructure. The Act defines an operator of essential services as any public or private operator offering a service essential to the functioning of society or the economy whose continuity could be gravely affected by an incident touching the electronic communications networks or information systems needed to provide it.
Article 3 leaves which operators receive that designation, and how essential infrastructure is determined, to a decree in Council of Ministers. The same Article leaves the content of the cybersecurity rules those operators must follow to a decree in Council of Ministers as well. Article 6 creates the Agence nationale de la cybersécurité (ANCy) as a public legal person with financial autonomy. ANCy designates the operators of essential services.
ANCy fixes the protective measures an operator of essential services must implement to secure its essential infrastructure, and controls the operator's compliance with them through inspections. ANCy grants or withholds an operator's accreditation based on that compliance. ANCy collects technical information about an incident affecting an operator's essential infrastructure.
ANCy may impose astreintes or sanctions, including monetary ones, on an operator that does not meet its cybersecurity obligations. The modalities of control and the sanctions applicable for non-compliance are themselves left to a decree in Council of Ministers. ANCy also certifies hardware, software and IT services for their capacity to perform cybersecurity functions.
When LexLint raises it
operates_essential_service
Read the law
Journal Officiel de la République togolaise, 63e année n° 24 ter, numéro spécial du 07 décembre 2018
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.