Encryption Law by Country
Where strong encryption is a right, restricted, or compelled. National law and policy, mirrored per country.
Source: Global Partners Digital, World Map of Encryption, updated 2026-07-02. Full data at www.gp-digital.org/world-map-of-encryption
Encryption Law by Country (196)
General right to encryption
No known legislation or policies.
Mandatory minimum or maximum encryption strength
No known legislation or policies.
Licensing/registration requirements
No known legislation or policies.
Import/export controls
No known legislation or policies.
Other restrictions
No known legislation or policies.
Obligations on individuals to assist authorities
Under section 130 of the Search and Surveillance Act 2012, a person with a search power in respect of data held in a computer system or other data storage device may require a specified person to provide access information and other information or assistance that is reasonable and necessary to allow the person exercising the search power to access that data. This could include a requirement that they decrypt information which is necessary to access a particular device. The search power cannot be used to require the specified person give any information tending to incriminate them (section 130(2)), however this does not prevent a person exercising a search power from requiring the specified person to provide information or providing assistance that is reasonable and necessary to allow the person exercising the search power to access data held in, or accessible from, a computer system or other data storage device that contains or may contain information tending to incriminate the specified person (section 130(3)). Failure to assist a person exercising a search power when requested to do so under section 130(1), without reasonable excuse, is a criminal offence punishable with imprisonment for up to three months (section 178). A copy of the law can be found here .
Obligations on providers to assist authorities
Section 9(1) of the Telecommunications (Interception Capability and Security) Act 2013 requires all network operators to ensure that public telecommunications networks and telecommunications services have “full interception capability”. This includes a duty to ensure that the interception capability is developed, installed, and maintained (section (9(3)). The duty is only complied with if every surveillance agency that is authorised under an interception warrant or any other lawful interception authority to intercept telecommunications or services on that network, or the network operator concerned, is able to – amongst other things – identify and intercept telecommunications, and obtain call associated data and the content of those telecommunications (section 10(1)). Network operators must decrypt telecommunications on that operator’s public telecommunications network or telecommunications service if they have been encrypted and the network operators provided that encryption (section 10(3)). However this does not require them to decrypt telecommunications that were encrypted by a product supplied by a person other than the operator and is available to the public, or was supplied by the operator as an agent for that product (section 10(4)). Nor does it require them to ensure that surveillance agencies have the ability to decrypt any telecommunication (section 10(4)). Together, these duties mean that network operators cannot design and implement end-to-end encryption. Under section 24 of the Act, where a network operator or service provider is shown an interception warrant which has been issued to a surveillance authority, it must assist the surveillance agency. This assistance includes “taking all other reasonable steps that are necessary for the purpose of giving effect to the warrant or lawful authority”, including decrypting telecommunications where they have provided the encryption. As with the duties under sections 9 and 10, this does not, however, require them to decrypt telecommunications that were encrypted by a product supplied by them as an agent for that product, or supplied by another person where the product is available to the public (section 24(4)). Nor does it require them to ensure that surveillance agencies have the ability to decrypt any telecommunication (section 24(4)). A copy of the law can be found here . Under section 130 of the Search and Surveillance Act 2012, a person with a search power in respect of data held in a computer system or other data storage device may require a specified person to provide access information and other information or assistance that is reasonable and necessary to allow the person exercising the search power to access that data. This could include a requirement that they decrypt information which is necessary to access a particular device. The search power cannot be used to require the specified person give any information tending to incriminate them (section 130(2)), however this does not prevent a person exercising a search power from requiring the specified person to provide information or providing assistance that is reasonable and necessary to allow the person exercising the search power to access data held in, or accessible from, a computer system or other data storage device that contains or may contain information tending to incriminate the specified person (section 130(3)). Failure to assist a person exercising a search power when requested to do so under section 130(1), without reasonable excuse, is a criminal offence punishable with imprisonment for up to three months (section 178). A copy of the law can be found here .
Assessment Text Area
In New Zealand, network operators must ensure that public telecommunications networks and telecommunications services have “full interception capability”. This includes a duty to ensure that the interception capability is developed, installed, and maintained, meaning that network operators cannot design and implement end-to-end encryption. Failure to assist a person exercising a search power when requested to do so is a criminal offence punishable with imprisonment for up to three months.
Murphy's Law