The Lebanese government retains several state-owned monopolies within the telecommunications sector. The state-owned enterprise Ogero owns and operates all fixed-line telecommunications services in Lebanon, while the two mobile and internet service providers, Touch and Alfa, are likewise under state ownership. In 2002, Lebanon enacted Law No. 431 to provide for the privatisation of the telecommunications sector; however, this legislation has yet to be implemented.

The telecom sector is fully owned by the Lebanese state, which holds full ownership of the fixed-line operator Ogero Telecom and the two mobile network operators, Alfa and Touch.

Lebanon does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, it is reported that an obligation of accounting separation can be found in the Significant Market Power Regulation (Decision No. 3/2009). Moreover, according to Art. 30 of the Telecommunications Law, the Telecommunications Regulatory Authority (TRA) may require SMP operators to comply with accounting rules or take any other precautionary measures as deemed appropriate to ensure a competitive market.

Reports indicate that the licensing framework set out in the Telecommunications Law is not operational and independent. In fact, the Telecommunications Regulatory Authority (TRA), which woud be in charge of issuing new licences, has operated without a functioning board for most of the past two decades. As such, the telecommunications sector remains entirely owned, managed, and regulated by the Ministry of Telecommunications.

Lebanon has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments. In fact, the country is not a member of the WTO.

Lebanon maintains a telecommunications regulatory body known as the Telecommunications Regulatory Authority (TRA). Nevertheless, evidence suggests that the decision-making processes within this entity are not entirely autonomous from governmental influence. While the Lebanese telecommunications legislation is formally overseen by the TRA, which functions as a semi-independent advisory body reporting directly to the Council of Ministers, in practice, the TRA possesses limited authority, thereby rendering the Ministry of Telecommunications the de facto regulatory authority. It is further reported that, although the TRA is nominally independent, its operations are frequently subject to the influence of dominant political factions, which significantly undermines its effectiveness. Former Ministers of Telecommunications have asserted that the TRA lacks substantive power, as the legislative provisions conferring its authority have yet to be fully implemented.

It is reported that the Central Bank of Lebanon (CBL) has mandated that digital service providers host their data within the country and refrain from utilising cloud-based solutions. In addition, CBL requires all banking institutions to maintain data backups domestically, with the same obligation extending to service providers.

Lebanon has not joined any agreement with binding commitments to open transfers of data across borders.

Lebanon lacks a comprehensive legal framework for personal data protection, although there are certain regulatory provisions in this area. Law No. 81 of 10 October 2018 on Electronic Transaction and Personal Data (قانون رقم 81 المعاملات الالكترونية و البيانات ذات الطابع الشخصي) provides the basic legal structure for safeguarding personal data. Yet, the law does not establish an independent data protection authority, imposes relatively limited obligations on data controllers and processors, and omits a definition of consent or explicit provisions governing its requirement and conditions. Nonetheless, it incorporates specific privacy-related obligations, including data subjects’ rights, transparency requirements, information disclosure, data retention rules, and the handling of sensitive personal data, while also prescribing criminal penalties for breaches of its privacy provisions.

Art. 72 of Law on Electronic Transaction and Personal Data requires IT service providers to retain data relating to traffic generated by all individuals using their services. This obligation is intended to facilitate the identification of users and includes the preservation of other technical information associated with communications for a period of three years, beginning on the date the service is implemented. For the purposes of this provision, IT service providers include any business or organisation that enables users to access an electronic communications network and provides direct information transmission services. The term also applies to data hosts, which are systems used to store third-party information of any nature, whether free of charge or for remuneration, and to make such information publicly accessible through direct communication services.

It is reported that, in 2013, the office of the public prosecutor issued a directive requiring all internet service providers (ISPs) and internet cafés to retain communications data for a period of one year. The directive instructs all providers of landline and wireless internet services for residential and corporate use, as well as cafés and shops that supply clients with devices enabling internet access, to implement all necessary measures to activate and preserve Internet log files transmitted through their servers and routers. In addition, they are required to create periodic backup copies to safeguard these files against loss, ensuring their retention for a minimum duration of one year.

According to Art. 9 of the Telecommunication Interception Act, the interception of communications may be authorised by an administrative order issued by either the Minister of the Interior or the Minister of Defence, subject to prior approval by the Prime Minister, for the purpose of gathering information aimed at combating terrorism, crimes against state security, and organised crime. To be lawful, such judicial or administrative interception orders must be in writing, duly justified, and should specify the means of communication subject to interception and the duration of interception, which may not exceed two months and cannot be extended except in accordance with the same rules and conditions. It is also reported that in recent years the cabinet has passed motions giving the security agencies temporary but unhindered access to all telecommunications metadata. Alfa and Touch, which are Lebanon’s two main mobile network operators and are owned by the government, are compelled to comply with these measures.

Lebanon has not signed the World Intellectual Property Organization (WIPO) Copyright Treaty.

Lebanon is not a signatory of the 1996 World Trade Organization (WTO) Information Technology Agreement (ITA) nor the 2015 expansion (ITA II). In fact, the country is not a member of the WTO.