Privacy Regulations in Lesotho

Continental framework treaty bundling data protection, cybercrime, cybersecurity, and e-commerce. Does not directly regulate websites but sets minimum standards for national laws. Took 9 years to reach the 15-ratification threshold. South Africa notably has not ratified.

One of the earlier data protection laws in Southern Africa, but severely limited by the fact that the Data Protection Commission has never been appointed. Consent is required for processing on paper, but enforcement is effectively non-existent. The Commission also lacks power to impose fines when appointed, relying on a courts-only enforcement model.