Timor-Leste has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Timor-Leste has enacted national legislation, namely the Decree-Law No. 12/2024, which is founded upon and influenced by the standards set forth in the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Timor-Leste has enacted national legislation, namely the Decree-Law No. 12/2024, which is founded upon and influenced by the standards set forth in the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

Chapter V of "Decree-Law No. 15/2012 of 28 March 2012 on the Regulation of the Telecommunications Sector" mandates that any natural or legal person intending to provide telecommunications services must first register with the National Communications Authority. In accordance with Annex A of the "ANC Guidelines on Registration", telecommunications services includes cross-border services that either originate in or terminate within the territory of Timor-Leste. This scope explicitly encompasses value-added network application services, which, pursuant to Schedule 58, include electronic transaction services such as e-commerce. In addition, a registrant is required to deliver such services via a service node located within Timor-Leste or through a local access node that is interconnected with the public telecommunications network.

In accordance with the schedules outlined in Annex I of the "ANC Guidelines on Registration", registrants of telecommunications services—including those providing international simple resale services, resale of leased circuit services, public internet access services, virtual private network services, managed data network services, mobile virtual network operations, IP telephony services, satellite mobile telephone or data services, and mobile communications on aircraft—are required to register their subscribers and maintain a comprehensive register containing detailed records of their personal particulars.

Chapter V of "Decree-Law No. 15/2012 of 28 March 2012 on the Regulation of the Telecommunications Sector" stipulates that any individual or entity intending to provide telecommunications services must register with the National Communications Authority. In accordance with annex A of the "ANC Guidelines on Registration", the scope of different types of services encompasses cross-border services either originating from or terminating within Timor-Leste. These include, but are not limited to, the following categories: virtual private network (VPN) services, internet-based voice and data services (VoIP), value-added network application services, and machine-to-machine (M2M) services.

It is reported that, in most cases, importing goods into Timor-Leste requires the involvement of a licensed customs broker. These professionals are authorised by the Timor-Leste Customs Authority to act on behalf of importers or exporters, facilitating the clearance of goods. They submit the necessary customs declarations through the Automated System for Customs Data (ASYCUDA), the electronic platform used by the Timor-Leste Customs Service.

It is reported that traders must obtain a Taxpayer Identification Number (TIN) and then secure an import authorisation from the Business Registration and Verification Service (SERVE). For imports deemed to be of lower risk, SERVE issues authorisation automatically. Conversely, imports classified as medium or high risk necessitate non-automatic import licences, which are issued by the relevant sectoral ministries or agencies. The processing time for such licences may extend up to one month.

It is reported that exporting goods from Timor-Leste requires the use of a licensed customs broker. Authorised by the Timor-Leste Customs Authority, these private sector professionals act on behalf of exporters to submit customs declarations and provide the necessary documentation, such as export licences and certificates of origin. Customs brokers facilitate shipment clearance in compliance with regulatory requirements.

It is reported that Timor-Leste lacks a formal mechanism for conducting transparent public consultations on all draft legislative proposals concerning technical regulations, standards, and conformity assessment procedures. It is noted that no such technical regulations, standards, or conformity assessment procedures—such as testing, inspection, or certification—are currently in place for either domestically produced or imported goods.

It is reported that Timor-Leste lacks a formal regulatory framework for type approval.

Timor-Leste does not yet possess a comprehensive legal framework for personal data protection. However, sector-specific regulations are in place. The legal framework addressing money laundering—namely, Law No. 17/2011 on the Legal Regime Covering the Prevention of and Combat against Money Laundering and the Financing of Terrorism, as amended by Law No. 5/2013—includes provisions on the processing of personal data for client identification purposes. Additionally, Law No. 20/2004 on the National Health System enshrines the right to privacy within both public and private healthcare sectors. Beyond these sectoral statutes, Decree-Law No. 19/2009, which promulgates the Penal Code, establishes criminal sanctions for breaches of privacy, including unlawful intrusions, violations of confidentiality, and the unauthorised interception of correspondence or telecommunications. In addition, the Constitution of Timor-Leste, in effect since May 2002, affirms the fundamental right to privacy under Art. 36. Art. 38 further addresses the protection of personal data, granting citizens the right to access their data, to be informed of the purposes for which it was collected, and stipulating requirements for obtaining consent in relation to the processing of certain categories of personal data.

Pursuant to Art. 6 of Government Decree No. 9/2008, telecom operators are required to retain user identification data—either electronically or in physical form—for a minimum duration of five years from the date of contract conclusion. In addition, Art. 7.4 stipulates that traffic data must be preserved for at least one year from the date of its generation. According to Art. 2, the term "operator" refers to any concessionaire or licensee that provides mobile telecommunications services via a subscription contract, utilising a SIM card.

In accordance with the schedules outlined in Annex I of the "ANC Guidelines on Registration", registrants of telecommunications services, including those providing international simple resale services, resale of leased circuit services, public internet access services, virtual private network services, managed data network services, mobile virtual network operations, IP telephony services, and satellite mobile telephone or data services, are required to maintain a register documenting the particulars of their subscribers. This register must be preserved by the registrant for a minimum duration of 12 calendar months following the termination of services to the respective subscriber. In addition, registrants of IP telephony services and satellite mobile telephone or data services shall maintain call detail records (CDRs) of all calls made and received via the service, insofar as such services are operated and/or provided within the territory of Timor-Leste, for a period of no less than 12 calendar months. Also, registrants of machine-to-machine (M2M) services are required to maintain a register containing complete and accurate records of all SIM cards utilised in connection with the provision of M2M services. These records must include, at a minimum, the international mobile subscriber identity (IMSI) number and the mobile subscriber integrated services digital network number (MSISDN) associated with each SIM card. The register shall be retained by the registrant for a period of not less than 12 calendar months from the date of termination of the M2M services to the subscriber.

In accordance with Section 5.5 of the "Guidelines on the Registration of SIM Cards for Prepaid Mobile Services", the National Communications Authority is empowered to request from any service provider offering prepaid mobile services the complete set of both physical and electronic subscriber’s registration records. These records must be submitted within 24 hours of receipt of such a request, in the format and through the means as may be prescribed by the Authority from time to time. The provision does not stipulate the necessity of a court order for such a request. The data required during the registration process includes the subscriber’s full name, residential address, and the type and number of the identification document presented.