The Council of Ministers, meeting on July 7, 2026, adopted draft law no. 042/2026 on combating cybercrime. This sweeping legislation aims to overhaul Madagascar's legal framework and address new digital challenges in the island nation. Comprising 96 articles across 12 chapters, the new law replaces the obsolete 2014-006 law, which has become outdated amid rapid technological evolution. Facing a surge in online scams, cyberstalking, information manipulation, and sophisticated cyberattacks, the Executive has decided to take decisive action. The draft, now submitted to the National Assembly for parliamentary examination that promises to be contentious, fundamentally reshapes the landscape of security, digital freedoms, and investigations in Madagascar.

Creation of UPIN: Toward Direct Data Access
The most prominent and controversial measure in this draft law is undoubtedly the creation of the Digital Protection and Investigation Unit (UPIN). Directly attached to the Prime Minister's office, this new structure positions itself as the operational national contact point, available 24/7. Its primary mission: coordinate actions and streamline international and national cooperation with key entities such as INTERPOL, SAMIFIN, ARTEC, CNIL, and CRT. However, Article 75 of the text has already generated considerable debate in both public and legal circles. It grants UPIN direct and permanent technical access to computer systems of telecommunications operators, Internet service providers (ISPs), registration centers, and other organizations holding data essential to investigations. This access covers identification data, subscription information, traffic data, and, where applicable, content.

Certainly, each consultation must be recorded in a secure and unalterable log—noting the agent's identity, time, data consulted, and file—kept available to the prosecutor and investigating judge. Notification to these authorities is also required within 24 hours for any traffic or content consultation, with the possibility of ordering the interruption of the measure or destruction of data. Furthermore, the text stipulates that any use of this access for purposes outside UPIN's mission constitutes abuse of office severely punished under the Penal Code. Despite these safeguards, the measure raises legitimate questions about respect for privacy and individual freedoms, a delicate balance that deputies will need to scrutinize carefully.

Mobile Money Traceability and Tougher Sanctions
The draft goes further and significantly tightens regulations on economic actors, platforms, and internet users. Articles 32 to 34 require social networks and hosting providers to remove, within a strict 24-hour deadline, any content flagged as illicit by UPIN. Failure to do so exposes them to heavy administrative and criminal penalties. Articles 59 to 62 clarify the responsibility of these technical intermediaries in case of inaction regarding manifestly illegal publications.

On the financial front, Articles 48 to 51 aim to clean up electronic transactions and counter money laundering. Operators are now required to conduct formal and rigorous identification of all SIM card holders. Moreover, a formal obligation to report suspicion is established whenever a mobile money transaction reaches or exceeds 10 million ariary, a provision welcomed by economic observers in the fight against the underground economy.

The societal and personal protection component is equally robust. The text drastically increases penalties related to online child pornography (Articles 22 and 23), specifically criminalizes the distribution of sexual images or videos without the consent of the person concerned, and strengthens repression of cyberstalking, particularly when targeting women. Furthermore, Article 63 introduces a formidable obligation: any person implicated must provide investigators access to their protected digital devices. Refusal to comply is punishable by imprisonment and a dissuasive fine.

Civil Society Speaks Out
While the government defends a text it deems essential and urgent to bring order to Madagascar's internet—also targeting disinformation (Article 31)—civil society organizations have begun to mobilize.