Namibia's Cybercrime Bill: Where It Stands and How to Protect Your Business

Where Namibia's Cybercrime Bill Stands (November 2026)

The Ministry of Information and Communication Technology (MICT) resumed stakeholder consultations on the draft on 2 February 2026, with sessions in Windhoek and in the regions, including one in Rundu for stakeholders from Kavango East, Kavango West and Zambezi. In April 2026 the Ministry held a validation workshop with government, law enforcement, the private sector and civil society. The national budget estimates for 2026/27 described the drafting as complete and said the bill would be reviewed by the Ministry of Justice and Labour Relations and validated before it goes to Parliament.

Before it becomes law, the bill still has to be tabled and passed by the National Assembly, reviewed by the National Council, signed by the President and published in the Government Gazette. The draft says the Act would come into operation on a date published in the Gazette, which may be later than the date it is passed. Timelines have slipped before, so treat any predicted date with caution and check the National Assembly's Order Papers for progress.

A Long Road: From Early Drafts to the 2026 Bill

The current bill is the latest attempt in a long process. According to the Institute for Public Policy Research (IPPR), drafts of a cybercrime law have surfaced since 2013.

The Minister has linked the delays partly to a shortage of local expertise in cyber law. In January 2026 she said the bill would be aligned with the UN Convention, and the draft includes a full part on international cooperation.

Challenges and opportunities. The challenges for cyber security in Namibia are plain: no dedicated cybercrime law yet, a shortage of specialist skills and threats that keep growing. The opportunities are just as real: a national response team since 2025, national incident management guidelines launched in April 2026, and a bill that would give investigators modern tools once it is passed.

What the Draft Bill Would Criminalise

The draft dated 30 January 2026 is the most detailed public text. It would create offences in four groups:

• Attacks on systems and data: unauthorised access to computer data, intercepting data without authorisation, interfering with a computer system, modifying data without permission, disclosing passwords or other access credentials, and making, selling or possessing tools designed to commit these offences.
• Computer-related crimes: computer fraud and forgery, phishing, spamming intended to disrupt systems, spreading malware that causes damage, identity theft and impersonation, using fake profiles to cause harm, cyberbullying, cyber extortion (not yet defined in the draft), cyberterrorism, and cybersquatting — using someone else's name, trade mark or domain name online without the right to do so.
• Content offences: child sexual abuse material and online grooming, sharing intimate images without consent, and certain pornography offences.
• Online copyright infringement for gain, and attempting, aiding or conspiring to commit any of these offences.

The penalties in the draft are heavy. Unauthorised access, for example, carries a fine of up to N$ 3 million, up to three years' imprisonment, or both; computer fraud carries a fine of up to N$ 2 million or three times the value of the advantage gained, whichever is greater, or up to ten years' imprisonment.

Expect changes. The January draft contains obvious drafting errors — some fines are expressed in pounds rather than Namibia dollars — and the IPPR has argued that several offences are drafted too broadly and could affect IT professionals, security researchers and journalists. Other commentators have criticised the clause that would make the bill prevail over any other law on cybercrime and cybersecurity matters.

What It Would Mean for Businesses and Service Providers

Most of the bill is about punishing criminals, but it also gives investigators new powers that would reach businesses holding data. The draft defines a service provider broadly: anyone who lets users communicate by means of a computer system, and anyone who processes or stores computer data for such a service or its users. That could include internet and email providers, hosting and cloud companies, and possibly businesses that run their own online platforms. (The draft also contains a second, narrower definition — another sign that the text is unfinished.)

Under the January 2026 draft:

• Preservation notices. A new National Cybercrime Prosecution Unit under the Ministry of Justice could require whoever holds specified traffic data (who communicated with whom, when and how) to preserve it for up to 90 days, or to disclose enough of it to identify the other service providers involved.
• Production orders. On application to a court, any person in Namibia could be ordered to hand over specified data, and any service provider offering services in Namibia to hand over subscriber information.
• Search, seizure and assistance. Under a warrant, investigators could seize or copy data, and order anyone who knows how a system works, or how its data is protected, to provide the information needed.
• Real-time collection and interception. With a court order, service providers could be compelled, within their technical capabilities, to collect traffic data or content in real time, and to keep that fact confidential.
• Deletion orders. A court could order unlawful material to be removed or destroyed.
• Moderating content. An administrator of an online account would have to moderate and control “undesirable content” once an investigating authority brings it to their attention. This is one of the most criticised clauses.
• Critical infrastructure. Owners of systems designated as critical infrastructure would have to report cybersecurity incidents to CRAN within 24 hours and have the systems audited.

CRAN could also issue directives to service providers and impose administrative penalties, and the Minister could make regulations on how data is preserved and retained. None of this applies yet. A sensible step today is simply to decide who in your business would receive and answer an official request for data, and to know what logs and records your systems actually keep.

How It Fits With the Electronic Transactions Act and the Data Protection Bill

The Electronic Transactions Act, 2019

The Electronic Transactions Act makes electronic messages, contracts and evidence legally valid, provides for consumer protection in online sales, for the accreditation of security services and products, and regulates when service providers are liable for their clients' content. Most of it has been in force since 16 March 2020. According to the Legal Assistance Centre's annotated text, the section on electronic signatures and the chapter on accreditation of security services followed on 15 June 2026; the consumer protection chapter had not yet been brought into force.

Its chapter on service providers is directly relevant if you host websites or data: companies that provide telecommunications, website hosting or development, or data storage and backup are not liable for unlawful third-party material if they meet certain conditions, such as acting quickly on a valid written take-down notice. A host only gets this protection if it has designated an agent for such notices and published the agent's contact details on its website.

The Act does not create hacking or phishing offences. ITWeb reported in July 2026 that, until a cybercrime law is in place, the authorities rely on existing laws such as the Electronic Transactions Act and the Communications Act.

The Data Protection Bill

The two bills do different jobs. The Cybercrime Bill punishes the people who attack systems and steal data. The Data Protection Bill sets the rules for the organisations that hold personal data — including how it is secured and when a breach must be reported. A single ransomware attack on a business could therefore involve both. As of 28 October 2026, the Minister's motion to introduce the Data Protection Bill was listed on the National Assembly's Order Paper. Our guide to Namibia's Data Protection Bill explains what it would require of your website.

Cyber Security in Namibia: The Attacks Small Businesses Face

The threats facing Namibian businesses are the same everyday attacks seen worldwide. NAM-CSIRT, the national response team, recorded 161 547 cyber events and 513 921 vulnerabilities between April and June 2026, and has warned about new ransomware that steals data before encrypting it.

• Phishing. Emails, SMSes or WhatsApp messages that imitate a bank, a courier, a supplier or your email provider and ask you to “confirm” a password or open an attachment. One stolen mailbox password is often all an attacker needs.
• Business email compromise. A criminal reads or imitates a real email conversation and sends an invoice or a “new banking details” message at exactly the right moment. FNB Namibia has warned that these attacks are tailored to specific people and harder to spot than ordinary spam.
• Ransomware. Files and servers are encrypted and a ransom is demanded, increasingly with the threat of publishing stolen data. In December 2024 Telecom Namibia's customer data was leaked after a ransomware attack, and NAM-CSIRT supported the response.
• Weak and reused passwords. Passwords stolen in one breach are tried on email, banking and remote-access logins everywhere else. In June 2026 NAM-CSIRT contacted 13 Namibian organisations whose firewall administrator and VPN credentials were potentially exposed in a global incident.
• Unpatched and exposed systems. Old software, open remote-desktop ports and forgotten admin panels on routers, firewalls and websites.

In our experience as a hosting provider, most problems start with something ordinary — a reused password, a missed update or a convincing email — rather than a sophisticated hack. That is good news, because ordinary problems have ordinary fixes.

A Cyber Security Checklist for Namibian SMEs

You do not need to wait for the new law. Work through this list, and repeat it once a year:

1. Turn on multi-factor authentication (MFA) for email, banking, accounting, hosting and social media accounts. NAM-CSIRT lists it among its core recommendations.
2. Use a unique, strong password for every account, stored in a password manager, and never share logins between staff.
3. Install updates promptly on computers, phones, routers, firewalls and your website software. Our guide to website maintenance explains what a website needs.
4. Keep backups you can restore. At least one copy should be offline or separate from your main systems, so ransomware cannot encrypt it too. Test a restore every few months.
5. Authenticate your email domain with SPF, DKIM and DMARC, so criminals cannot easily send emails in your name. We explain all three in why emails go to spam.
6. Confirm every change of banking details by phone, using a number you already have on file, never the one in the email.
7. Give each person only the access they need, use separate administrator accounts, and remove access the day someone leaves.
8. Close what you do not use: remote-desktop access, old user accounts, unused plugins and admin panels open to the internet.
9. Choose secure hosting. Look for HTTPS on every page, daily backups and a provider that applies security updates. Our web hosting includes free SSL certificates and daily backups, and our business email hosting comes with the SPF, DKIM and DMARC records set up for you.
10. Keep your domain in your business's name and make sure it renews on time — a lapsed domain takes your email with it. We register Namibian and international domains on our domain registration page.
11. Train your team to pause before clicking, and make it easy and blame-free to report a suspicious message.
12. Write a one-page incident plan: who to call, where the backups are, and the contact details of your bank, IT provider and the authorities listed below.

What to Do After a Cyber Incident in Namibia

Act quickly, but calmly. These steps apply whether you clicked a phishing link, paid a fake invoice or found your files encrypted:

1. Contain it. Disconnect affected computers from the network and Wi-Fi. Leave them switched on if you can, so evidence is not lost.
2. Secure your accounts from a clean device: change passwords, sign out all other sessions and turn on MFA.
3. If money is involved, call your bank immediately. The sooner the bank knows, the better the chance of stopping a payment.
4. Keep the evidence: the suspicious emails (with their headers), screenshots, ransom notes, transaction references, dates and times.
5. Report the crime to the Namibian Police. Dial 10111 or go to your nearest police station; you will receive a case number. The police have a Cybercrime Unit. Keep the case number for your bank, insurer and IT provider.
6. Report the incident to NAM-CSIRT at report@nam-csirt.na (office +264 61 222 666, Monday to Friday, 08:00 to 17:00), or through its incident reporting page. Include your contact details, a short summary, the systems affected and the estimated impact. NAM-CSIRT's formal constituency is critical infrastructure, but its 2026 national incident guidelines ask that high-impact incidents be reported for the national record and encourage voluntary reporting.
7. Tell your hosting and IT providers, so they can check servers, mailboxes and backups.
8. Inform the people affected if their personal data may have been exposed. NAM-CSIRT's guidelines recommend keeping customers informed of a major incident or data breach, and the Data Protection Bill's last published draft would require it.
9. Get professional advice before engaging with extortionists. Paying does not guarantee that you get your data back or that stolen data is deleted.
10. Learn from it. Once things are stable, note how the attacker got in and close that gap.

A Note on Legal Advice

This article summarises publicly available information as of 3 November 2026 for general guidance only. It is not legal advice. The Cybercrime Bill is still a draft and its final wording may differ from what is described here. If you need to know your obligations, speak to a qualified legal practitioner, and follow the National Assembly's Order Papers and the Government Gazette for progress.