Skip to main content

    AI by country · Southeast Asia

    AI in Timor-Leste: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Timor-Leste know before starting with AI?

    Timor-Leste has no data protection law and no AI law as of 29 October 2026. Article 38 of the Constitution protects personal data, and the Ombudsman says the Court of Appeal has found the missing law to be a failure the state must fix. A cybersecurity law package that includes personal data rules went to Parliament in July 2026, so a company should handle data carefully now and watch for the new laws.

    At a glance

    Timor-Leste at a glance

    Key facts about Timor-Leste
    Data protection lawNo data protection law as of 29 October 2026. Article 38 of the Constitution protects personal data
    RegulatorNo data protection regulator yet. The Ombudsman (PDHJ) has called for an independent Data Protection Commission
    AI policyDigital Transformation Strategy 2026 to 2036 in draft, with AI as a theme. No AI law as of 29 October 2026
    Time zoneUTC+9, no daylight saving (3.5 hours ahead of India)
    CurrencyUSD (US dollar)
    Business languageTetum and Portuguese (official); English and Indonesian are working languages

    Why now

    Why Timor-Leste is worth watching

    Each point links to the document it comes from.

    • In January 2026 the Ombudsman (PDHJ) said a binding Court of Appeal decision had upheld its petition on the absence of a data protection law, making the law a legal obligation.[2]

    • On 22 July 2026 the Council of Ministers approved a request to Parliament for authority to adopt a cybersecurity law package that includes rules on personal data and privacy.[3]

    • A new interministerial committee, set up on 6 August 2026, coordinates cybersecurity, data protection and digital government work.[7]

    • The government held a public consultation in April 2026 on a Digital Transformation Strategy 2026 to 2036 that includes rules for emerging technologies such as AI.[4]

    • A Government Dialogue on AI on 24 August 2026 was set up to feed into the strategy and a future national AI framework.[5]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Constitution of Timor-Leste (2002), Article 38: protection of personal data

    In force2002Citizens can see personal data held about them, ask for corrections and ask what it is used for. Processing sensitive data, such as beliefs, religion, party or union membership or ethnic origin, without the person's consent is prohibited. Article 38 says the law will define personal data and set rules for it, but that law does not exist yet.[1]

    Proposed law authorising the cybersecurity legislative package

    Draft2026The proposal would let the government adopt laws on cyberspace security, digital service providers, digital crimes and electronic evidence, and rules on personal data and privacy. It was submitted to Parliament in July 2026. We found no report that Parliament has approved it, so its status is unclear as of 29 October 2026.[3]

    Digital Transformation Strategy 2026 to 2036

    Draft2026This is a government strategy, not a law. Its draft pillars include digital governance, digital health, rural connectivity, cybersecurity and regulatory frameworks for emerging technologies such as AI. The final version was due after the April 2026 consultation, and we did not find it.[4]

    Where AI fits first

    Where AI fits first

    Government services

    Search and summarisation over policy documents, and drafting replies to citizens in Tetum and Portuguese, with officers checking outputs.

    The AI dialogue in August 2026 aimed to identify priority public-sector AI uses and listed data governance and human oversight as topics.[5]

    Telecoms and digital services

    Customer service chatbots and fraud alerts.

    The proposed cybersecurity package would set duties for digital service providers, including procedures for removing or blocking illegal content.[3]

    Education and skills

    Study aids and teacher support tools in local languages.

    The national AI readiness assessment with UNESCO recommended digital skills training and clear governance and data protection frameworks.[6]

    Your first steps

    Your first steps

    1. Get clear consent before using sensitive data such as religion, beliefs or ethnic origin, as Article 38 of the Constitution requires.
    2. Let people see and correct the personal data you hold about them, and tell them what it is used for.
    3. Write down what personal data your AI uses and where it is stored, including any servers abroad.
    4. Keep a person reviewing AI outputs before they affect customers or citizens.
    5. Set basic security and incident steps now, since a cybersecurity law package is before Parliament.
    6. Watch for the data protection and cybersecurity laws and the final Digital Transformation Strategy, and review your setup when they appear.

    AI services for Timor-Leste

    AI consulting and development for teams in Timor-Leste

    We work remotely with companies in Timor-Leste, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Timor-Leste is on UTC+9 with no daylight saving, and India is on UTC+5:30, a 3.5 hour gap. Taking a 9:00 to 17:00 day in Dili and 9:30 to 18:30 in India, the overlap is about 4 hours, from 13:00 to 17:00 Dili time.

    Questions

    Common questions about AI in Timor-Leste

    Does Timor-Leste have a data protection law?

    Not as of 29 October 2026. Article 38 of the Constitution protects personal data, and the Ombudsman reports that the Court of Appeal found the lack of a law to be a failure the state must correct.

    Is there an AI law or AI strategy?

    There is no AI law. A Digital Transformation Strategy 2026 to 2036 with AI as a theme went to public consultation in April 2026, and a government AI dialogue was held in August 2026.

    What is in the cybersecurity package?

    The government asked Parliament in July 2026 for authority to adopt laws on cybersecurity, digital services, digital crimes and electronic evidence, plus rules on personal data and privacy. We could not confirm whether Parliament has approved it.

    What should we do while the laws are being written?

    Follow Article 38: get consent for sensitive data, let people see and correct their data, and keep records of how your AI uses it. This will make it easier to comply when the new laws arrive.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Constitute Project, 2026-10-29. Timor-Leste's Constitution of 2002(constituteproject.org)
      Full title and what we used it for

      Timor-Leste's Constitution of 2002. Text of the Constitution in English. Used for Article 38 on personal data, Article 13 on official languages and Article 159 on working languages.

    2. [2] Provedoria dos Direitos Humanos e Justiça (PDHJ), the Ombudsman, 2026-01-15. PDHJ calls for comprehensive digital laws and strong institutions to pr…(pdhj.tl)
      Full title and what we used it for

      PDHJ calls for comprehensive digital laws and strong institutions to protect Timorese rights. Statement by a state human rights body. Used for the absence of a data protection law, the Court of Appeal decision on PDHJ's 2025 petition and the call for a Data Protection Commission. The page gives no case number or date for the court decision, and we could not read the decision itself.

    3. [3] Tatoli, Agência Noticiosa de Timor-Leste, 2026-07-31. Govt submits proposal to parliament seeking legislative authorisation t…(en.tatoli.tl)
      Full title and what we used it for

      Govt submits proposal to parliament seeking legislative authorisation to approve cybersecurity legislation package. State news agency report. Used for the Council of Ministers approval on 22 July 2026, the contents of the package and its submission to Parliament. We could not find the bill text or a record of a parliamentary vote.

    4. [4] Tatoli, Agência Noticiosa de Timor-Leste, 2026-04-17. Govt holds public consultation on Timor-Leste's Digital Transformation…(en.tatoli.tl)
      Full title and what we used it for

      Govt holds public consultation on Timor-Leste's Digital Transformation Strategy 2026 to 2036. State news agency report. Used for the consultation, the lead ministry and the strategy's pillars, including AI. We could not open the draft strategy.

    5. [5] Tatoli, Agência Noticiosa de Timor-Leste, 2026-08-21. Timor-Leste to host Government Dialogue on Artificial Intelligence(en.tatoli.tl)
      Full title and what we used it for

      Timor-Leste to host Government Dialogue on Artificial Intelligence. State news agency report. Used for the 24 August 2026 dialogue, its topics and its link to the strategy and a future national framework.

    6. [6] Catalpa International, 2026-10-29. Co-designing Timor-Leste's Path to Inclusive AI(catalpa.io)
      Full title and what we used it for

      Co-designing Timor-Leste's Path to Inclusive AI. Project page by the organisation that delivered the assessment with UNESCO, the Ministry of Transport and Communications and TIC Timor. Used for its recommendations. The page gives no date for the assessment.

    7. [7] Tatoli, Agência Noticiosa de Timor-Leste, 2026-08-07. Government establishes Interministerial Committee on Cybersecurity and…(en.tatoli.tl)
      Full title and what we used it for

      Government establishes Interministerial Committee on Cybersecurity and the Digitalisation of State Services. State news agency report. Used for the committee set up on 6 August 2026 and its remit, which includes data protection.

    This is general information, not legal advice. Timor-Leste's data protection and cybersecurity laws are still being prepared, and several points rest on reports by the state news agency because we could not read the draft texts. Check with a qualified lawyer in Timor-Leste before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Timor-Leste?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score