Section 52 of the Data Protection Act of 2012 provides that the transfer of personal information abroad is permitted when the laws of the destination country are substantially similar to the information protection principles in Lesotho or when other conditions are met, including the data subject consent to the transfer, the use of binding corporate rules, or the necessity of the transfer for the performance of a contract between the data subject and data controller.

Lesotho has not joined any free trade agreement committing to open transfers of cross-border data flows.

The Data Protection Act provides a comprehensive regime of data protection in Lesotho. The Act sets out data subject rights, data processing notifications and the legal bases for processing. However, the Data Protection Commission provided for in the Data Protection Act is yet to be established.

Regulation 5 of the Communications (Subscriber Identity Module Registration) Regulations mandates that licensees must retain the subscriber information obtained during registration. According to Regulation 2, a licensee is defined as an entity licensed by the Authority to provide and facilitate communication services, commonly referred to as a network operator or service provider. Subscriber information encompasses the personal details of a subscriber that are recorded and stored by a licensee. Regulation 14 further requires licensees to maintain a record of subscriber details that have been electronically verified by the National Identity and Civil Registry.
In addition, under Regulations 10 and 23, licensees are required to retain records of any deactivation, deregistration, and SIM swap information. SIM swap information must be kept in a traceable database for a period prescribed by the Authority.
According to Regulation 15:
- When the subscriber is a company, the licensee must retain details of both the company and its authorised representative.
- When the subscriber is a company employee, and the company is under contract with the licensee, the licensee must retain details of both the company and the employee.
- When the subscriber is an institution, the licensee must retain details of both the institution and its representative.
- When the subscriber is a child, the licensee must retain details of both the child and the parent or guardian.
- When the subscriber is a visitor, the licensee must retain the visitor's personal details.
- When the subscriber is a foreigner, the licensee must retain the foreigner's personal details.
- When the subscriber is a refugee, the licensee must retain details of the refugee.
- When the subscriber is a diplomat, the licensee must retain the diplomat's personal details.

Section 58 of the Data Protection Act obligates every data controller to appoint one or more Data Protection Officers. Moreover, Section 20 sets out a reciprocal security obligation on both data controllers and their data processors to secure data in their possession or control 'by adopting appropriate, reasonable, technical and organisational measures to prevent loss, damage, or unauthorised destruction, and unlawful access to, or unauthorised processing of data'.

A basic legal framework on intermediary liability for copyright infringement is absent in Lesotho's law and jurisprudence.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Lesotho's law and jurisprudence.

Regulation 7 of the Communications (Subscriber Identity Module Registration) Regulations of 2021 requires licensees (entities licensed by the Lesotho Communications Authority to provide and facilitate communications services) to register subscriber information. Licensees must capture, register, and retain the personal information of subscribers who request SIM registration and activation, following the registration specifications, at no cost to the subscriber.

It is reported that Lesotho does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there is an obligation of accounting separation.

Lesotho has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

According to the Lesotho Telecommunications Act, the Lesotho Communications Authority (LCA), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

According to Art. 78.1 of the Public Procurement Act, which repeals the Public Financial Management and accountability Act of 2011, a work, supply and service tender up to a sum specified in Schedule 2 shall be fully reserved for indigenous Basotho, women, youth and people with disabilities owned SMEs, with a maximum turnover not exceeding an amount specified in Schedule 2. An exemption from the application may apply with a prior approval of the Authority where the Authority is satisfied that there is no 100% indigenous SMEs or disadvantaged groups suitable and qualified for the tender is available. Specifically, for SMEs that are 100% owned by indigenous Basotho, the threshold is set at LSL 2,000,000 (approx. USD 106,000) per tender, with an annual turnover not exceeding LSL 2,000,000 (approx. USD 106,000).

Lesotho is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA) nor does it have observer status.

The Business Licensing and Registration Regulations of 2020 (BLRR 2020) restrict certain businesses to Basotho, allowing foreign investors to participate only as minority shareholders, with a maximum shareholding of 49%. However, these restrictions are not relevant to digital trade.

Section 11.3(f) of the Companies Act of 2011 requires companies to provide names and addresses of one or more persons resident in Lesotho with authority to act on behalf of the company, while Section 17(b) of the Companies Regulations of 2012 explicitly makes it mandatory for the company to have a company secretary resident in Lesotho.