Timor-Leste has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Timor-Leste has enacted national legislation, namely the Decree-Law No. 12/2024, which is founded upon and influenced by the standards set forth in the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Timor-Leste has enacted national legislation, namely the Decree-Law No. 12/2024, which is founded upon and influenced by the standards set forth in the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

Pursuant to Art. 6 of Government Decree No. 9/2008, telecom operators are required to retain user identification data—either electronically or in physical form—for a minimum duration of five years from the date of contract conclusion. In addition, Art. 7.4 stipulates that traffic data must be preserved for at least one year from the date of its generation. According to Art. 2, the term "operator" refers to any concessionaire or licensee that provides mobile telecommunications services via a subscription contract, utilising a SIM card. “Traffic data” refers to the functional data necessary to establish a connection or communication, as well as data generated during network use, including the identification of outgoing and incoming calls, call duration, and date and time.

In accordance with the schedules outlined in Annex I of the "ANC Guidelines on Registration", registrants of telecommunications services, including those providing international simple resale services, resale of leased circuit services, public internet access services, virtual private network services, managed data network services, mobile virtual network operations, IP telephony services, and satellite mobile telephone or data services, are required to maintain a register documenting the particulars of their subscribers. This register must be preserved by the registrant for a minimum duration of 12 calendar months following the termination of services to the respective subscriber. In addition, registrants of IP telephony services and satellite mobile telephone or data services shall maintain call detail records (CDRs) of all calls made and received via the service, insofar as such services are operated and/or provided within the territory of Timor-Leste, for a period of no less than 12 calendar months. Also, registrants of machine-to-machine (M2M) services are required to maintain a register containing complete and accurate records of all SIM cards utilised in connection with the provision of M2M services. These records must include, at a minimum, the international mobile subscriber identity (IMSI) number and the mobile subscriber integrated services digital network number (MSISDN) associated with each SIM card. The register shall be retained by the registrant for a period of not less than 12 calendar months from the date of termination of the M2M services to the subscriber.

In accordance with the schedules outlined in Annex I of the "ANC Guidelines on Registration", registrants of telecommunications services, including those providing international simple resale services, resale of leased circuit services, public internet access services, virtual private network services, managed data network services, mobile virtual network operations, IP telephony services, satellite mobile telephone or data services, and mobile communications on aircraft, are required to maintain a register containing records of their subscribers and their particulars. This register shall be made available for inspection by authorised government agencies of Timor-Leste, without the need for a court order.

A basic legal framework on intermediary liability for copyright infringement is absent in Timor-Leste's law and jurisprudence.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Timor-Leste's law and jurisprudence.

Pursuant to Art. 4 of Government Decree No. 9/2008, contracts for mobile telecommunications services involving SIM cards must include verified identification of the user. For natural persons, this entails presenting a current identity document bearing a photograph. For legal entities, identification must be established through a registration certificate or an equivalent document attesting to the company’s legal existence. Foreign users are reportedly required to present a valid passport at the time of purchase. Additionally, under Art. 6.1, service providers are required to retain user identification data, in either physical or electronic form, for a minimum of five years following the conclusion of the contract.

In accordance with the schedules outlined in Annex I of the "ANC Guidelines on Registration", registrants of telecommunications services—including those providing international simple resale services, resale of leased circuit services, public internet access services, virtual private network services, managed data network services, mobile virtual network operations, IP telephony services, satellite mobile telephone or data services, and mobile communications on aircraft—are required to register their subscribers and maintain a comprehensive register containing detailed records of their personal particulars.

Chapter V of "Decree-Law No. 15/2012 of 28 March 2012 on the Regulation of the Telecommunications Sector" stipulates that any individual or entity intending to provide telecommunications services must register with the National Communications Authority. In accordance with annex A of the "ANC Guidelines on Registration", the scope of different types of services encompasses cross-border services either originating from or terminating within Timor-Leste. These include, but are not limited to, the following categories: virtual private network (VPN) services, internet-based voice and data services (VoIP), value-added network application services, and machine-to-machine (M2M) services.

Under Art. 32(1) of the Customs Code, a customs broker licence is required only where a person submits a customs declaration in the name of, or on behalf of, another person. However, it is reported that, in practice, most imports into Timor-Leste require the involvement of a licensed customs broker. These brokers are authorised by the Timor-Leste Customs Authority to act on behalf of importers or exporters, including by submitting customs declarations through the Automated System for Customs Data (ASYCUDA), the electronic platform used by the Timor-Leste Customs Service.

It is reported that exporting goods from Timor-Leste requires the use of a licensed customs broker. Authorised by the Timor-Leste Customs Authority, these private-sector professionals act on behalf of exporters to submit customs declarations and provide the necessary documentation, including export licences and certificates of origin. Customs brokers facilitate shipment clearance in compliance with regulatory requirements.

It is reported that Timor-Leste lacks a formal mechanism for conducting transparent public consultations on all draft legislative proposals concerning technical regulations, standards, and conformity assessment procedures. It is noted that no such technical regulations, standards, or conformity assessment procedures—such as testing, inspection, or certification—are currently in place for either domestically produced or imported goods.

It is reported that Timor-Leste lacks a formal regulatory framework for type approval.