My company works in Libya. What does the law ask of us when an AI agent reads our data?
The short answer
I found no comprehensive personal data protection law in force in Libya as of October 2026. The closest binding rules are in the chapter on protecting private data in Law 6 of 2022 on electronic transactions. Anyone who controls personal data through their work in electronic transactions must tell people how their data is protected before processing it, and a transfer outside Libya must take account of the level of protection in the receiving country. The national AI strategy plans a data protection and privacy law by 2026, but I found no such law issued.
The law that applies
I found no comprehensive personal data protection law in force in Libya as of October 2026. What exists is narrower.
In 2022 the House of Representatives issued two laws on the digital field: Law 5 of 2022 on combating cybercrime, and Law 6 of 2022 on electronic transactions. Both are listed on the House’s website. The official copy of Law 6 is a scanned image. Its seventh chapter, Articles 73 to 78, is titled protection of private data.
Can the agent read personal data at all?
Law 6 of 2022 sets two kinds of rules.
The first kind applies only to public bodies and certification service providers. Such a body may collect personal data directly from the person, or from others, after the person’s explicit consent, and only to issue a certificate, keep it, or make that easier. It may not collect, process or use the data for any other purpose without the person’s explicit consent. The law makes collection, disclosure or processing lawful without that consent where it is necessary to prevent or detect a crime at the official request of investigating bodies, where a law or a court decision requires or permits it, where it is needed to assess or collect a tax or fee, or where it protects an urgent vital interest of the person.
Article 79 adds four limits on these bodies:
- They may not send electronic documents to the person whose data they collected if the person explicitly refuses to accept them.
- They may not process the person’s personal data if the person explicitly refuses.
- They may not process the data if the processing causes harm to the people concerned, or infringes their rights or freedoms.
- They may not use the data for any purpose other than the one agreed, except with the person’s consent.
The second kind applies more widely. Anyone who controls personal data through their work in electronic transactions must, before processing it, inform the person by a special notice of the steps taken to protect the data. The notice must name who is responsible for the processing, and state the nature of the data, the purpose, the methods and places of processing, and all information needed to ensure safe processing.
These rules come from a law on electronic transactions, not from a general data protection law. They do not set up a regulator for personal data, and I found no Libyan authority that supervises personal data protection as such.
The model provider, and data sent abroad
The law says that where personal data must be transferred outside Libya, the appropriate level of protection must be taken into account. It lists in particular the nature of the data, the source of the information in it, the purposes and duration of the processing, the receiving country with its international obligations and its law, the relevant rules in that country, and the security measures taken there to protect the data. The article does not name an authority that approves transfers.
A certification service provider must take proper steps to keep personal data confidential. It may not disclose, transfer, announce or publish that data for any purpose without the person’s prior consent.
When something goes wrong
In the chapter on personal data I found no duty to report a breach. Anyone who commits the acts in Article 79 faces detention of at least one year and a fine of 3,000 to 10,000 dinars, unless another law sets a heavier penalty. The penalty becomes imprisonment and a fine of at least 10,000 dinars where the acts breach electronic transactions of the government, military or security institutions, or banks.
What Libya says about AI itself
The General Information Authority publishes the National Artificial Intelligence Strategy in the State of Libya 2025 to 2030, dated December 2025. Its second pillar covers legislation and ethics. It plans to review, update or issue a data protection and privacy law by 2026, with the Ministry of Justice responsible. It says the proposed law is inspired by the European General Data Protection Regulation, GDPR, and by UNESCO’s recommendations, adapted to the Libyan context. The strategy also plans a national framework for AI ethics in 2026.
The strategy is a plan, not a law. I found no Libyan law that regulates AI as such, and no data protection law issued under the strategy, as of October 2026.
What this means for you
- Before the agent processes personal data in electronic transactions, give people a notice that says who is responsible, what data is used, why, and how and where it is processed.
- If you are a public body or a certification service provider, use personal data only for the purpose the person agreed to, and stop when a person explicitly refuses.
- Before the agent sends personal data to a model provider outside Libya, check the level of protection in that country against the points the law lists.
- Watch for the data protection law the AI strategy plans, because it may change your obligations quickly.
I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.