…as stakeholders seek to fix contentious provisions before legislation returns to Parliament
Moroke Sekoboto
THE protracted Cybersecurity Bill is once again under scrutiny as the government has convened regulators, financial institutions, law-enforcement agencies, service providers and other stakeholders to address concerns surrounding the proposed legislation before it proceeds to the next stage of the legislative process.
The two-day consultation on the Cybersecurity Bill 2026, organised by the Ministry of Information, Communications, Science, Technology and Innovation (MICSTI), the Lesotho Communications Authority (LCA) and the United Nations Development Programme (UNDP), began at Victory Hall in Maseru yesterday.
The consultations are being held against the backdrop of repeated attempts by the government to introduce cybersecurity legislation, with earlier versions facing strong objections from several stakeholders and ultimately failing to make it through the legislative process.
The 2021 version was withdrawn from Parliament and returned to the responsible ministry after Members of Parliament adopted a resolution to send it back for further work.
The government subsequently introduced the Computer Crime and Cyber Security Bill 2024, which was referred to Parliament for consideration. But the 2024 version also encountered resistance.
Media and civil society organisations raised concerns about provisions they argued could undermine freedom of expression, privacy and other constitutional rights. At a December 2024 high-level cybersecurity meeting, media and civil society representatives maintained that although cybersecurity legislation was necessary, the Bill appeared to give insufficient attention to human-rights safeguards.
Media Institute of Southern Africa (MISA) – Lesotho Chapter subsequently called for the 2024 Bill not to be enacted in its existing form, arguing that it needed to be revised to incorporate submissions made by civil society organisations. MISA had also previously criticised the legislative process for failing to provide meaningful and inclusive consultation with affected groups, civil society and technical experts.
It is these concerns — together with the need to separate cybersecurity governance from the criminal-law aspects of cybercrime — that have contributed to the Bill’s prolonged journey towards enactment.
Acting Principal Secretary in MICSTI, ‘Maleloko Nkhahle, said the current consultation was intended to strengthen Lesotho’s cyber resilience by ensuring that the country’s legal framework was fit for purpose.
“The consultation forms part of the government’s ongoing efforts to strengthen Lesotho’s national cybersecurity framework,” Ms Nkhahle said.
“Cybersecurity Bill 2026 is the culmination of a process that began with the Computer Crime and Cybersecurity Bill 2024, which initially sought to address cybersecurity governance and cybercrime under a single legislative framework.”
She said that following consultations and policy considerations, Cabinet approved the separation of the 2024 Bill into two pieces of legislation — the Cybercrime Bill 2026 and the Cybersecurity Bill 2026.
The separation is intended to allow the two laws to deal more specifically with their respective areas of regulation.
The latest consultation brings together the LCA, Revenue Services Lesotho, Central Bank of Lesotho, Financial Intelligence Unit, Directorate on Corruption and Economic Offences and service providers, among others.
The stakeholders are examining the proposed legislation, making recommendations and providing technical input before the Bill advances through the legislative process.
Ms Nkhahle said government had already begun implementing aspects of its national cybersecurity agenda despite the absence of the new legislation.
One of the measures was the designation of the LCA as the agency for the Computer Security Incident Response Team (CSIRT).
The CSIRT is intended to minimise and control damage arising from data breaches, cyberattacks and other security incidents, while providing guidance on recovery.
It will also be responsible for containing threats, eradicating malware, restoring affected systems, investigating breaches, tracking the extent of damage and identifying vulnerabilities exploited by attackers.
The CSIRT will further serve as a central point for reporting security incidents, notifying affected stakeholders and coordinating responses with legal and management teams.
Ms Nkhahle also highlighted the National Cybersecurity Forum launched in July 2026, bringing together representatives from government, the private sector, academia, civil society and the technical community.
She said the forum was intended to provide a platform for dialogue, information sharing, capacity building and the development of a cybersecurity culture.
The 2026 Bill also introduces a framework for the recognition, registration and oversight of cybersecurity professionals.
According to Ms Nkhahle, this is intended to promote professional standards, accountability and ethical conduct as cyber threats become increasingly complex and organisations become more dependent on specialised cybersecurity services.
The Bill proposes a two-tier regulatory framework, with obligations differentiated according to the nature, size, criticality and risk profile of regulated entities.
The government argues that the approach would prevent unnecessary compliance burdens while ensuring that entities facing greater cybersecurity risks are subject to appropriate safeguards.
MICSTI Chief Legal Officer, ‘Makamohelo Mofilikoane, said the Bill would establish institutional structures for managing cybersecurity in Lesotho and regulate the prevention, management and response to cybersecurity threats and incidents.
It would also provide for the identification and declaration of critical information infrastructure.
Under the proposed framework, a National Cybersecurity Agency would be established, together with a National Cybersecurity Committee.
The LCA, Central Bank and Lesotho Electricity and Water Authority are identified as competent authorities, alongside other public bodies that may be designated to oversee cybersecurity policies, regulations and standards within specific sectors.
The Bill defines a cybersecurity incident as an event that compromises the availability, authenticity, integrity or confidentiality of data or services provided through network and information systems.
It also defines cybersecurity risk as the potential for loss or damage to network and information systems, the services they support or the data they process as a result of a threat exploiting a vulnerability.
The current workshop is the second stakeholder engagement process on the 2026 Bill following circulation of the draft legislation in August for stakeholder review.
The consultations are scheduled to continue today.
