Processes personal data, in Djibouti

Code Numérique, Livre Premier, Arts. 104, 135 et 140 à 156 (Commission et sanctions) · Read the law's page

• Comply with a formal notice the Commission addresses to you, or expect an injunction, a withdrawal of authorization, the locking of the data concerned, or an administrative sanction of up to 70,000,000 Djiboutian francs or 5% of your worldwide turnover, whichever is higher, plus a daily penalty payment for continued non-compliance.
• Expect a criminal prosecution carrying imprisonment and a fine under Chapter 6 for processing without the required prior formalities, for an unauthorized transfer, for an unlawful disclosure, or for another offence that chapter creates, on top of the Commission's own administrative sanction for the same facts.

Code Numérique, Livre Premier, Arts. 14 et 15 (notification des atteintes à la sécurité) · Read the law's page

• Notify the Commission Nationale de Protection des Données à Caractère Personnel of a personal-data breach without undue delay and, at the latest, within 72 hours of becoming aware of it, stating the reasons for any delay beyond that window.
• Tell the affected individual of the breach without undue delay, in clear and simple terms, where it is likely to result in a high risk to their rights and freedoms.
• As a processor, notify the controller of a personal-data breach without undue delay after becoming aware of it.
• Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned, the contact point, the likely consequences, and the measures taken or proposed to address it, and supply the information in stages where it cannot all be given at once.
• Keep a register of every personal-data breach, its facts, its effects and the remedial measures taken, and make it available to the Commission on request.

Code Numérique, Livre Premier, Arts. 59 et 62 (consentement du mineur et données sensibles) · Read the law's page

• Do not process sensitive personal data (racial or ethnic origin, political or philosophical opinions, religious opinions or beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, or health data) without the data subject's express consent or another statutory ground.
• Let a minor consent alone to an information-society service's processing of their personal data only from age 16, obtain the consent of the person holding parental authority below that age, and make reasonable efforts to verify it given the technology available.

Code Numérique, Livre Premier, Arts. 99 à 102 (transferts vers un pays tiers) · Read the law's page

• Do not transfer personal data to a country or international organization outside Djibouti unless it offers an adequate level of protection or another authorized safeguard applies.
• Apply the same adequacy or safeguard requirement to an onward transfer from the destination country or organisation to a further one, not only to the first transfer out.
• Where you rely on an Article 102 exception instead, use one the article lists, and where that is the data subject's consent, obtain it expressly for the specific transfer.

Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Premier, Arts. 2 à 13, 54, 57 et 66 à 73 (objet, champ d'application, obligations du responsable de traitement et formalités préalables) · Read the law's page

• Obtain a lawful basis, most often the data subject's express, unambiguous, free, specific and informed consent, before processing their personal data.
• Build data protection into the design and the default settings of your processing, restrict processing to persons acting under your authority and on your instructions, and take the measures necessary to secure personal data against loss, alteration, or unauthorized access, having regard to its nature and the risks the processing presents.
• File a prior declaration with, or obtain the prior authorization of, the Commission Nationale de Protection des Données à Caractère Personnel before processing personal data, depending on the processing's risk category.