According to Arts. 3 and 8 of the Regulations Governing Internet of Things Services for the Year 2021, any legal entity that wishes to provide Internet of Things (IoT) services commercially or for private purposes using bandwidth outside buildings must submit a written application for a licence to the Director General of the Authority, in accordance with the Communications and Postal Regulation Law for the year 2018 and the relevant licensing regulations. The Regulations define the Internet of Things as a global infrastructure for the information society that enables advanced services through the interconnection of physical and virtual objects, based on existing and evolving information and communications technology to ensure interoperability.

According to Administrative Decision No. 75 of 2023, adopted pursuant to Art. 15 of the Communications and Postal Services Regulation Law of 2018 and Board Decision No. 17 of 2019 of the Communications and Postal Services Regulatory Authority, the import of mobile phones more than four years old is prohibited. Only mobile phones that are three years old or newer may be imported. Companies operating in this field and licensed to import mobile phones are required to comply with this restriction as of 1 June 2023.

Sudan has not joined any agreement with binding commitments to open transfers of data across borders.

Sudan does not have a comprehensive regime in place for personal data, but it has the Electronic Transactions Act 2007 as a sectoral regulation. A data protection authority has not yet been appointed.

According to Art. 6 of the Anti-Money Laundering and Combating the Financing of Terrorism Act 2014, financial and non-financial institutions are required to keep records and data relating to customers and transactions and ensure that these records and information are made available to the competent authorities with reasonable speed. The records must be kept for a period of at least five years after the termination of the business relationship or the execution of the incidental transaction, whichever is longer. The article also stipulates that records and data relating to domestic and international transactions, whether executed or attempted, should be kept for at least five years after the transaction, and such records shall be detailed enough to allow the steps of each transaction to be tracked separately.

According to Art. 25(t) of the Telecommunications and Postal Regulation Law, telecommunications operators shall grant the Telecommunication and Postal Regulation Authority access to their facilities, networks and equipment, and to allow the installation of devices necessary for performance measurement and monitoring. It is reported that, under this framework, telecommunications companies are required to provide customer data to the authorities upon request.

A basic legal framework on intermediary liability for copyright infringement is absent in Sudan's law and jurisprudence.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Sudan's law and jurisprudence.

Sudan has not signed the World Intellectual Property Organization (WIPO) Copyright Treaty.

Sudan has not signed the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Sudan lacks a comprehensive regime for the protection of trade secrets.

The Infrastructure Sharing Regulation for the Year 2020 governs both passive (non-active) and active infrastructure sharing in Sudan. According to Arts. 3-9 owner-operators are required to make their infrastructure available for sharing, prepare a reference offer approved by the regulator, act in a transparent and non-discriminatory manner, negotiate with access seekers, and publish and periodically update information on sharable infrastructure. Annex 1 specifies that passive infrastructure includes, inter alia, towers and masts, ducts, trenches, cable stations and sites, cables, cabins, buildings, roofs, shelters and related utilities, while active infrastructure covers antennas and antenna systems, base stations (e.g. BTS/NodeB), radio network controllers (e.g. RNC/BSC), radio access networks (including feeder cables), backbone and transmission networks, backhaul links, local loops and bitstream access.

According to Art. 18 of the Investment (Encouragement) Act, foreign investment is restricted in certain sectors as designated by the Minister. It is reported that such restrictions include a prohibition on foreign capital participation in most areas of telecommunications services.
Art. 3 of the Regulations for the Provision of Virtual Network Operator Services for the Year 2016, also requires that anyone wishing to provide virtual network operator (VNO) services must apply for a licence in accordance with the Telecommunications Law of 2001 and the regulations issued pursuant thereto (Art. 3.1), and that the licensee must be a Sudanese company with a Sudanese capital share of not less than 60% (Art. 3.2). The Regulations define a Virtual Network Operator as a public mobile communications service provider that does not have a dedicated frequency spectrum and does not own a public communications network infrastructure, but may own limited infrastructure.

It is reported that the government holds a 30% ownership stake in Sudatel, one of the three main telecommunications and internet service providers in the country.

It is reported that Sudan mandates both functional and accounting separation for operators with significant market power (SMP) in the telecom market. However, the relevant law has not been found.