The CAR has signed but not ratified the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

The CAR has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

According to Law No. 18.002, the introduction of satellite telephones into the country is subject to authorisation by the competent authorities. According to Art. 62 of the law, any sale of a satellite phone must be reported to the regulatory authority along with the buyer's details.

According to Art. 147 of Law No. 18.002, the importation of cryptology equipment without prior authorisation is subject to a penalty of between one and five million CFA francs (approx. USD 1,760 - 8,810), imprisonment of between one and three months, or both.

The Central African Republic has a national regulatory framework for standardisation and quality management since the enactment of Law No. 19.004. However, the countries is still in the process of establishing its National Standardisation Agency. Once established, the Agency will be the only institution authorised to adopt international standards and formulate national standards.
In the absence of national rules, imports must, in principle, be accompanied by a certificate of conformity (CdC) with international technical regulations.
It is reported that all products exported to the CAR are subject to the Pre-shipment Inspection Programme. Third-party results may be accepted under certain conditions. The following are accepted:
- laboratories accredited according to ISO/IEC 17025 or equivalent;
- Supplier's laboratories, provided that the installation is under the company's certified quality management system and whose key elements of the ISO/CEI 17025 standard are respected. The text of the law is not available online.
Regarding telecom equipment, Art. 92 of Law No. 18.002 stipulates that terminal equipment intended for connection to a publicly accessible network must undergo approval and certification by the Regulatory Authority. Moreover, approval and certification are mandated for all radio equipment and installations, irrespective of whether they are intended for connection to a public network. Art. 93 specifies that approval and certification confirm the equipment or installation's compliance with the technical standards and specifications established by the International Telecommunication Union (ITU). Additionally, Art. 97 provides that terminal equipment requiring approval must not be manufactured for the domestic market, imported for consumption, held for sale, distributed (whether free of charge or for remuneration), connected to a publicly accessible network, installed, or advertised unless it has been approved and remains in continuous compliance with the applicable requirements.

Art. 100 of Law No. 18.002 provides that, in order to preserve the interests of internal or external State security and national defence, the supply, operation or use of cryptology means or services must be subject to:
- Prior declaration regime when the only purpose of this means or service is to authenticate a communication or to ensure the integrity of the message.
- Authorisation regime, with a written opinion from the Minister in charge of national security and internal security in other cases.
The Electronic Communications and Postal Regulatory Authority (ARCEP) must lay down the conditions under which the declaration or authorisation must be made or granted. It may provide for a simplified declaration or authorisation regime for certain types of equipment or services or for certain categories of users (Art. 101).

According to the Instruction No. 8/GR/2019 issued by the Governor of the Bank of Central African States to facilitate the interpretation and implementation of the Economic and Monetary Community of Central Africa (CEMAC) Regulation 02/18/CEMAC/UMAC/CM, there is a limit of 1 million XAF (approx. USD 1,700) per month and per person for the remote settlement of transactions, including online payments. According to Arts. 7-8, justification needs to be provided above this limit. The Instruction provides guidance on the provision of Art. 34 of the Regulation, which implements certain limits for using electronic payment instruments outside the CEMAC and applies to the six CEMAC member states, including the CAR.

It is reported that the de minimis threshold, that is the minimum value of goods below which customs do not charge duties, is XAF 30,000 (approx. USD 50), below the 200 USD threshold recommended by the International Chamber of Commerce (ICC).

Art. 21 of Law No. 24.001 stipulates that the controller of a data processing operation may transfer personal data to a foreign state only if the receiving state possesses legislation that guarantees a level of protection equivalent to that established by this law. Moreover, the transfer of personal data to a country that does not provide an equivalent level of protection may be permitted as an exception under specific conditions, including when the data subject, having been informed of the absence of such protection, has explicitly and unequivocally consented to the proposed transfer.

CAR has not signed any agreement with binding commitments on data transfer across-border.

Law No. 24.001 establishes a comprehensive legal framework for the protection of personal data in the Central African Republic. In addition to this general regime, sector-specific legislation governs data protection within the telecommunications sector. Notably, Law No. 18.002 of 17 January 2018, which regulates electronic communications, includes explicit provisions concerning the protection of users’ privacy in relation to electronic communication networks and services (Arts. 112–115), as well as the safeguarding of personal data (Arts. 116–126).

Art. 38 of Law No. 24.001 stipulates that every data controller must designate a data protection officer, tasked with ensuring compliance with the obligations set forth in the Law. Pursuant to Art. 40, only individuals residing within the territory of the Central African Republic who possess the requisite knowledge and qualifications to discharge their functions may be appointed as such officers.

It is reported that a basic legal framework for intermediary liability for copyright infringement is absent in The Central African Republic's law and jurisprudence.

It is reported that a basic legal framework for intermediary liability beyond copyright infringement is absent in The Central African Republic's law and jurisprudence.

According to Art. 61 of Law No. 18.002, telecom operators must identify all their subscribers. It is reported that there has been an identity requirement for SIM cards since 2014.