Sudan lacks a comprehensive framework for consumer protection that applies to online transactions.

It is reported that the de minimis threshold, that is the minimum value of goods below which customs do not charge duties, is USD 100. This is below the 200 USD threshold recommended by the International Chamber of Commerce (ICC).

Communication devices must comply with radio communications standards and specifications in terms of frequency bands and transmission power. It must meet the electromagnetic conditions and the health and environmental safety conditions. All communications-related devices and equipment are examined and matched to ensure their conformity with the specifications. The Authority is responsible for enforcing inspection procedures for all communications devices imported into Sudan and their compliance with the approved technical specifications. After conducting the examination and conformity process for the devices, the certificates received from the internationally competent laboratory are verified.

According to Art. 9 of the Press and Publications Act 2009, the National Council on Press and Publications (NCPP) issues practical approvals for several media companies, including advertising agencies. It is reported that the cost of issuing the licence is 400,000 pounds (approx. USD 900).

According to Art. 9 of the Press and Publications Act 2009, the National Council on Press and Publications (NCPP) issues practical approvals for press companies, institutions, presses, publishers, distributors, service centres and advertising agencies.
For newspapers and other forms of press-related publications to be duly published, the following requirements must be met:
- Obtain a permit from the NCPP upon payment of the fees provided for in the Regulations (Art. 21.a);
- Authorisations/licences may be renewed on an annual basis upon payment of the fees provided for in the Regulations (Art. 21.b).
It is reported that the cost of issuing the licence for each media service and news sites is 400,000 pounds (approx. USD 900).

It is reported that the Cybercrime Act has been used to block access to online news websites. In September 2022, it was ordered the blockage of the website of the Al-Sudani newspaper.

It is reported that in December 2020, the Telecommunications and Post Regulatory Authority (TPRA) approved regulations on content filtering and website blockage. The report mentions the regulations give TPRA the mandate to block certain categories of websites, including gambling sites, peer-to-peer file-sharing websites, VPN websites, websites which call for atheism, and websites of “any additional classifications that the authority considers.” It is further reported that under Art. 8 of the Regulations (which are not available online), ISPs must immediately block websites once they receive a TPRA notice or face fines of up to 300,000 pounds (approx. USD 500).

The indicator "6.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 1 in Sudan. This corresponds to "The government shut down domestic access to the Internet numerous times this year."

A basic legal framework on intermediary liability beyond copyright infringement is absent in Sudan's law and jurisprudence.

It is reported that in Sudan, customers must show passports at the point of sale of sim cards and provide a copy of the passport with a form to fill in. Once the procedure is done, customers may receive the sim card and activate it.
It is reported that, in July 2022, the Technical Committee of the Council of Security and Defense in Sudan ordered service providers to suspend all SIM cards that were not registered with a national ID number.

It is reported that mobile service providers are required to keep records of their customers' information, including full names, full addresses, other phone numbers and place of work. Moreover, the SIM card registration process links phone numbers to users' personal information. It is also reported that under the Telecommunication Law 2018, telecommunication companies must provide customer data to authorities upon request. The Telecommunications Law of 2018 is not available online.

A basic legal framework on intermediary liability for copyright infringement is absent in Sudan's law and jurisprudence.

Sudan does not have a comprehensive regime in place for personal data, but it has the Electronic Transactions Act 2007 as a sectoral regulation. A data protection authority has not yet been appointed.

According to Art. 6 of the Anti-Money Laundering and Combating the Financing of Terrorism Act 2014, financial and non-financial institutions are required to keep records and data relating to customers and transactions and ensure that these records and information are made available to the competent authorities with reasonable speed. The records must be kept for a period of at least five years after the termination of the business relationship or the execution of the incidental transaction, whichever is longer. The article also stipulates that records and data relating to domestic and international transactions, whether executed or attempted, should be kept for at least five years after the transaction, and such records shall be detailed enough to allow the steps of each transaction to be tracked separately.

Sudan has not joined any agreement with binding commitments to open transfers of data across borders.