Law No.14/2015 on guarantees and consumer protection, provides a comprehensive consumer protection framework that applies to online transactions.

Madagascar has signed but not ratified the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Madagascar does not implement any de minimis threshold, which is the minimum value of goods below which customs do not charge duties.

According to Decision No. 01 of the Ministry of Finance and Budget, wholesale trade is to be subjected to authorisation by the Directorate General of Taxes, equivalent to a licence. The decision granting this authorisation does not distinguish between physical trade and online trade, as long as wholesale trade is conducted in Madagascar.

According to Art. 2 of Decree No. 2009-048, e-payments relating to current transactions between a person resident in Madagascar and foreigners or non-residents of Madagascar are free but may only be made through licensed intermediaries. In addition, according to Art. 21 of the law, capital transactions and financial operations between a person resident in the Republic of Madagascar and those residents abroad carried out by holders of foreign currency accounts subscribed in the name of residents remain subject to prior authorization by the Ministry of Finance. Furthermore, pursuant to Art. 22 of the law, transfers from one foreign currency account to another foreign currency account are not authorized between residents, except in limited cases.

According to the Law on Electronic Money and Electronic Money Institutions, only licensed electronic payment institutions may provide online payment services (Arts. 2-3). The limits of the transactions are determined by the agreement between the institution and the user. In practice, access to online payment is therefore limited, with an estimated bank penetration rate of 6% and a financial penetration rate of 17% with mobile money.

Equipments intended to be connected to a network open to the public, terminal equipments must be approved by the Regulatory Agency or by a laboratory recognised or authorised by it (Art. 17 of Law No. 2005-023). The Regulatory Agency publishes and regularly updates a list of approved laboratories whose accreditations is automatically recognised. Once assigned for a particular brand and type of terminal equipment, the accreditation serves to immediately approve the distribution and use of any unit corresponding to that brand and type of equipment. However, in practice, the website recognises ARTEC's exclusive competence for approval and has not yet published the list of approved laboratories. There is a test of the terminal equipment in preparation for approval.

According to Art. 176 of the Law No. 2016-029, the Internet Service Providers (ISPs) and any other online service providers are obliged to monitor the content of the websites it supports. They shall notify the National Authority for the Regulation of Media Communication of any illegal activity or content of which they are aware. In the absence of immediate reporting, it is sanctioned by a fine of 1 million to 3 million Ariary (approx. USD 226 to USD 678). The article also states that the clients of a web host or the website owners must provide their real identity and exact contact details.

Art. 176 of the Law No. 2016-029 states that the clients of a web host and the website owners must provide their real identity and exact contact details.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Madagascar's law and jurisprudence.

It is reported that Madagascar imposes an identity requirement for SIM registration. Anyone wanting to purchase a SIM card has to provide their national ID card, or a passport in case of foreigners, to activate a new prepaid SIM card.

A basic legal framework on intermediary liability for copyright infringement is absent in Madagascar's law and jurisprudence.

According to Art. 51 of the law, any data controller (for all sectors) shall appoint a data protection officer (DPO). The designation of the DPO is notified to the Malagasy Commission on Information Technology and Liberties (CMIL), by any written procedure. The Commission shall keep an updated list of the designated delegates.

Madagascar has not joined any free trade agreement committing to open transfers of cross-border data flows.

Madagascar has a data protection framework, particularly with Law No. 2014 - 038. However, the Malagasy Commission on Information Technology and Liberties (CMIL) an independent authority responsible for monitoring the principles stipulated in the law is still not yet functional.

The processing of sensitive data (racial origin, biometric data, genetic data, political opinions, religious or other beliefs, trade union membership and data relating to health or sex life) is prohibited. Derogations exist when guarantees of appropriate processing are provided to the Malagasy Commission for Computer Liberties (Art. 18).