South Sudan is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), nor does it have observer status.

Section 323.4 of the Companies Act stipulates that small companies shall be exclusively owned by South Sudanese nationals. According to Section 323.3, a company qualifies as a small-sized private company if its turnover for the preceding accounting period is below a threshold specified by the government, it employs no more than seven individuals, and its share capital does not exceed an amount prescribed by the government. Furthermore, Section 323.5 mandates that financially capable South Sudanese nationals must hold a minimum of 31% of the shares in medium and large private companies. Section 323.6 defines a medium or large private company as one with share capital not less than an amount prescribed by the government. These regulatory restrictions reportedly extend to sectors pertinent to digital trade, including telecommunications, internet services, and computer-related services.

Art. 24 of the Mobile Money Regulation states that the Central Bank may, from time to time and in consultation with mobile money service providers, set transaction limits for mobile money service providers, their agents and consumers, including daily and periodic limits. It is reported that mobile money transfer companies should limit daily transactions to USD 300 per account and conduct biometric registration of their customers.

Somalia does not implement any de minimis threshold, which is the minimum value of goods below which customs do not charge duties.

Somalia lacks a consumer protection framework in place.

Somalia has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Somalia has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Somalia has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

All businesses operating in Somalia must be registered either with the Federal Ministry of Commerce and Industry or with the competent authority of the relevant Federal Member State. Under Art. 7 of Law No. 001/2021 on the Regulation of Company Law, the Registrar of Companies issues each incorporated private or public company with a unique business licence number, which functions as a general business licence aligned with the licensed activity. Art. 9 further provides that companies engaged in activities subject to prior approval under other Somali laws may not commence operations until they obtain the necessary sectoral authorisations in addition to this general licence.
According to the online Company Registrar/eBusiness portal, this framework is implemented through specific licence categories, including a dedicated e-commerce store licence (Dukaamada Dhijitaalka ah ee Ganacsiga) and a “General Retail & E-Commerce” licence (Tafaariiqda iyo Dhijitaalka Guud) for domestically established retail and online trading businesses.

Art. 29 of the Data Protection Act mandates that a data controller of significant importance must conduct a DPIA before commencing any processing activities that are likely to pose a high risk to the rights and freedoms of data subjects due to the nature, scope, context, or purposes of the processing. Additionally, the data controller is required to submit a data impact assessment report to the relevant authority prior to initiating the processing activities.

Art. 34 of the Data Protection Act stipulates that a data controller of significant importance must appoint a DPO who possesses expert knowledge of data protection laws and practices. The DPO is responsible for advising the data controller on its obligations under the Act, monitoring compliance with the Act and the data controller's related policies, and serving as the liaison with the Authority on matters concerning personal data processing. The DPO may either be an employee of the data controller or engaged through a service contract.

A basic legal framework on intermediary liability for copyright infringement is absent in Somalia's law and jurisprudence.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Somalia's law and jurisprudence.

According to Art. 67 of the National Telecommunications Law of 2017, communication companies must register all existing and new SIM cards and telephone line holders to secure customers' ownership and personal rights. To fulfil this requirement, customers must present valid personal identification documents to contract mobile services.

The government of Somalia has reportedly enacted several restrictions on web content and digital platforms in recent years. In 2019, authorities temporarily blocked access to major social media platforms, including Facebook, Twitter, WhatsApp, and YouTube, for a period of five days during national high school examinations, with the stated aim of preventing cheating and the unauthorised circulation of exam materials. More recently, in August 2023, the Ministry of Communications and Technology instructed internet service providers to block access to a range of platforms and websites, including TikTok, Telegram, and the online gambling site 1xBet. As of 2024, these platforms remain inaccessible within the country. Furthermore, in February 2024, the National Intelligence and Security Agency (NISA) announced the shutdown of 14 websites allegedly operated by the extremist group al-Shabab, as part of broader counterterrorism measures.