Between Digital Transformation and Regulatory Vacuum: Cybersecurity of Public Services in Mozambique

Vollständiger Abstract

Worum geht es in dieser Arbeit?

The rapid expansion of digital public services in Mozambique—including e-government platforms, digital health systems, and electronic tax administration—has outpaced the development of a coherent legal framework for cybersecurity. While Law No. 3/2017 (Electronic Transactions Law) of 9 January 2017 introduced foundational data-protection principles, Mozambique long lacked a dedicated cybersecurity regulatory authority, mandatory security standards, and formal incident-notification mechanisms. This regulatory vacuum exposed critical public services to escalating cyber risks as digital transformation was actively promoted as a development priority. This article examines the legal and institutional gaps in Mozambique's cybersecurity governance framework prior to the 2026 Cybersecurity and Cybercrime Laws, situating the analysis within the broader pattern of regulatory lag in developing countries. Drawing on regional experiences—South Africa, Rwanda, and Kenya—and continental instruments such as the Malabo Convention, the study identifies structural weaknesses in Mozambique's pre-2026 legal architecture and their implications for the resilience of digital public services. The article argues that closing this gap requires not merely new legislation, but enforceable institutional capacity, sector-specific security requirements, and alignment with international cybersecurity governance standards. The 2026 legislative reforms represent a decisive step; their effective operationalization will determine whether the vacuum is closed in practice. Policy recommendations are offered to guide a proportionate implementation pathway.