Sudan has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

Sudanese authorities are reportedly known to engage in website blocking and content filtering, particularly targeting social media and independent platforms. Although no new blocks on major websites or social media platforms were reported in 2023 and 2024, the government continues to restrict access to websites it deems “negative.” Various legal frameworks are reportedly used to justify these actions. In December 2020, the Telecommunications and Post Regulatory Authority (TPRA) issued regulations granting it the authority to block access to specific categories of websites, including those related to gambling, peer-to-peer file sharing, VPN services, advocacy of atheism, and other content deemed inappropriate by the authority. Under Art. 8 of these regulations—reportedly not publicly available—Internet Service Providers (ISPs) are required to block targeted websites immediately upon receiving a notice from TPRA, with non-compliance subject to fines of up to SDP 300,000 (approx. USD 500). In addition, the Cybercrime Act has reportedly been used to suppress access to online news outlets; for example, in September 2022, the website of Al-Sudani newspaper was ordered blocked under its provisions.

The indicator "7.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 1 in Sudan for the year 2024. This corresponds to "The government shut down domestic access to the Internet numerous times this year."
It is reported that Sudanese authorities regularly conduct internet shutdowns. In 2024 alone, at least four such disruptions were reported with months-long blackouts. Regional shutdown covered Darfur in January and Omdurman in September.

According to Art. 9 of the Press and Publications Act 2009, the National Council on Press and Publications (NCPP) issues practical approvals for several media companies, including advertising agencies. It is reported that the cost of issuing the licence is SDP 400,000 (approx. USD 900).

According to Art. 9 of the Press and Publications Act 2009, the National Council on Press and Publications (NCPP) issues practical approvals for press companies, institutions, presses, publishers, distributors, service centres and advertising agencies.
For newspapers and other forms of press-related publications to be duly published, the following requirements must be met:
- Obtain a permit from the NCPP upon payment of the fees provided for in the Regulations (Art. 21.a);
- Authorisations/licences may be renewed on an annual basis upon payment of the fees provided for in the Regulations (Art. 21.b).
It is reported that the cost of issuing the licence for each media service and news site is SDP 400,000 (approx. USD 900).

According to Arts. 3 and 8 of the Regulations Governing Internet of Things Services for the Year 2021, any legal entity that wishes to provide Internet of Things (IoT) services commercially or for private purposes using bandwidth outside buildings must submit a written application for a licence to the Director General of the Authority, in accordance with the Communications and Postal Regulation Law for the year 2018 and the relevant licensing regulations. The Regulations define the Internet of Things as a global infrastructure for the information society that enables advanced services through the interconnection of physical and virtual objects, based on existing and evolving information and communications technology to ensure interoperability.

According to Administrative Decision No. 75 of 2023, adopted pursuant to Art. 15 of the Communications and Postal Services Regulation Law of 2018 and Board Decision No. 17 of 2019 of the Communications and Postal Services Regulatory Authority, the import of mobile phones more than four years old is prohibited. Only mobile phones that are three years old or newer may be imported. Companies operating in this field and licensed to import mobile phones are required to comply with this restriction as of 1 June 2023.

It is reported that, since early 2024, Sudanese authorities have prohibited the import and possession of Starlink satellite internet devices. An official letter from the Director General of the Telecommunications and Post Regulatory Authority (TPRA) to the Director General of Police ordered the enforcement of a ban on the ownership of Starlink terminals and instructed the police to take all necessary measures to prevent their circulation and use.

According to Art. 19 of the Telecommunications and Postal Regulation Law, no person may assemble telecommunications or transmission devices, or manufacture, import, export or trade in such devices, without first obtaining a licence from the Board and the competent authorities.

According to Art. 19 of the Telecommunications and Postal Regulation Law, no person may assemble telecommunications or transmission devices, or manufacture, import, export or trade in such devices, without first obtaining a licence from the Board and the competent authorities.

Sudan has not joined any agreement with binding commitments to open transfers of data across borders.

Sudan does not have a comprehensive regime in place for personal data, but it has the Electronic Transactions Act 2007 as a sectoral regulation. A data protection authority has not yet been appointed.

According to Art. 6 of the Anti-Money Laundering and Combating the Financing of Terrorism Act 2014, financial and non-financial institutions are required to keep records and data relating to customers and transactions and ensure that these records and information are made available to the competent authorities with reasonable speed. The records must be kept for a period of at least five years after the termination of the business relationship or the execution of the incidental transaction, whichever is longer. The article also stipulates that records and data relating to domestic and international transactions, whether executed or attempted, should be kept for at least five years after the transaction, and such records shall be detailed enough to allow the steps of each transaction to be tracked separately.

According to Art. 25(t) of the Telecommunications and Postal Regulation Law, telecommunications operators shall grant the Telecommunication and Postal Regulation Authority access to their facilities, networks and equipment, and to allow the installation of devices necessary for performance measurement and monitoring. It is reported that, under this framework, telecommunications companies are required to provide customer data to the authorities upon request.

A basic legal framework on intermediary liability for copyright infringement is absent in Sudan's law and jurisprudence.