Timor-Leste has enacted a long-awaited, new legal framework for electronic transactions, records, and electronic signatures, particularly in the context of e-commerce.
Decree-Law No. 12/2024 of February 13th, which will enter into force on 18 August 2024, is approved in the context of the country’s global view towards digitalization under its Digital Strategy 2032 and seeks to answer a longstanding discussion over the need to facilitate and speed up electronic discussions and interactions between public and private stakeholders, in an increasingly digital society.

In this context, the diploma aims to promote economic growth and innovation and is technology-neutral, while also aligning Timor-Leste with international standards and best practices in the field of electronic commerce and electronic signatures.

This new law:

  • Applies to any individual or entity selling or offering goods or services through e-commerce to individuals or entities domiciled, headquartered, or established in Timor-Leste, regarding the formation and acceptance of electronic records, the use and legal status of electronic signatures, and the formation of contracts by electronic means. Acts such as wills, family law matters, real estate transactions requiring notarial intervention, judicial acts, and other specific documents are excluded therefrom.
  • Ensures the legal effectiveness of electronic records and signatures and their use as evidence in legal proceedings and sets out the conditions for the preservation of electronic records.
  • Designates the Agência de Tecnologias de Informação e Comunicação I.P. (TIC TIMOR) as accrediting authority for certifying entities for electronic signatures – it also outlines the responsibilities of certifying entities, including ensuring security levels for electronic signatures and providing reliable systems for storing certificates. Certificates may also be issued by entities based outside Timor-Leste, provided they offer equivalent reliability.
  • Prohibits sending unsolicited commercial electronic messages (spam) without a functional return email address or another mechanism for recipients to object to future messages.
  • Establishes a sanctioning regime, including administrative offenses punishable by fines ranging from US$ 500 to US$ 100,000, depending on the severity of the breach.

The new law represents a significant step forward for Timor-Leste in the digital era, as well as new obligations and challenges for businesses that operate or intend to operate in the e-commerce sector.

Businesses should prepare for this by taking necessary prior steps, including:

  • Review and update their website content and design to comply with the new requirements for transparency, information, and consent. For example, a Timor-Leste-based online retailer must ensure that its website clearly displays its business name, tax identification number, physical address, contact information, product prices, delivery options, and terms and conditions, including dispute resolution mechanisms.
  • Implement secure payment processing systems for protection of online transactions. For example, an e-commerce platform should use encryption, authentication, and verification methods to ensure the safety and confidentiality of the data transmitted and received.
  • Consider applying for accreditation with TIC TIMOR if they plan to issue electronic signatures and ensure that they meet all the requirements, including maintaining a secure and reliable system for issuing certificates (including identity and signature verification) and having valid insurance contract for liability coverage.
  • Update their email marketing strategies to include a functional return email address or opt-out mechanism. A company that sends promotional emails to potential or existing customers must provide them with a clear and easy way to unsubscribe from future messages.
  • Establish internal compliance procedures and train staff on the new legal requirements, such as monitoring and documenting online transactions and signatures, keeping records of their electronic communications, and reporting breaches or incidents to relevant authorities.

By following these steps, businesses can ensure preparation for the new law and that they can benefit from the opportunities and advantages generated thereby.

The new law is expected to boost the development of e-commerce in Timor-Leste, as well as to enhance the security and trust of online transactions and communications – while some adjustment and adaptation work is expected, the benefits in simplification and expediency are sure to facilitate business and commerce in the country.