Makes education decisions, in the Democratic Republic of the Congo

Code du numérique, Livre IV, Titre II, Chapitre I, et Titre III, Chapitre I, Section 1, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 276 et 281) · Read the law's page

• Cooperate in detecting cyberattacks in accordance with the applicable legal and regulatory provisions.
• Inform the Agence Nationale de Cybersécurité of every attack, intrusion or other penetration liable to impair the operation of another information system or network, so as to let the Agency take the measures necessary to address it, including isolating the affected system.
• Comply with the measures the Agence Nationale de Cybersécurité prescribes to put an end to the disruption.
• This binds the operator of an information system, public or private, and more broadly any natural or legal person operating in, or possessing expertise in, the digital sector, without any sector limitation.
• No fixed numerical notification deadline is stated; the duty runs from the operator's own awareness of the attack, intrusion or penetration.

Code du numérique, Livre IV, Titre III, Chapitre I, Section 2, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 295 à 297) · Read the law's page

• This binds a digital services provider (fournisseur des services numériques) generally, regardless of the sector in which it operates.
• Implement systems qualified to detect events likely to affect the security of your own information systems; the qualification of the detection systems and of the service providers operating them is delivered by the Ministry responsible for digital affairs, the Agence Nationale de Cybersécurité having been consulted.
• Submit your information system to controls the Agence Nationale de Cybersécurité conducts to verify its security level and its compliance with security rules, at your own cost.
• Expect the Agence Nationale de Cybersécurité to be able to obtain your users' or system holders' identity, postal address and electronic address when their systems are vulnerable, threatened or attacked, so as to alert them.

Code du numérique, Titre III, arts. 200, 207 à 218, 220, 235 à 237, 240 à 242 et 248 (droits de la personne concernée) · Read the law's page

• Give a data subject the information needed to know and contest the processing of their data on request, including confirmation of processing, the purposes, categories, recipients, retention period, and the existence of automated decision-making, and provide an access copy within sixty days.
• Give a data subject whose processing rests on consent or a contract and uses automated means their data in a structured, commonly used, machine-readable format on request, and transmit it directly to another controller where technically possible.
• Let a data subject object at any time, on legitimate grounds, to processing of their data, offer them that right expressly and free of charge before their data is first communicated to a third party or used for prospecting, and answer an objection within thirty days.
• Correct inaccurate, incomplete, ambiguous, outdated or unlawfully processed personal data on request and pass the correction on to every recipient within thirty days.
• Erase personal data on request within thirty days where it is no longer necessary, was unlawfully processed, or the data subject withdrew consent with no other legal basis remaining, and where you had made the data public, take reasonable technical steps to tell any third party processing it that erasure was requested.
• At collection, give the data subject your identity, the purposes and legal basis, the categories of data, the recipients, whether a reply is mandatory or optional, their rights of access, rectification, objection and complaint, the retention period, and any transfer to a third country; give the same information within a reasonable time when you did not collect the data from them directly.
• Do not charge a data subject for supplying information or acting on a request, and tell them in writing within thirty days if you do not act on their request.
• Tell a data subject before collecting or first using their data for information-society services aimed directly at them that they may set instructions for its management after their death.
• Where a data subject is an incapacitated adult, let their spouse or an appointed protector exercise their rights under this Title, and associate the data subject in that exercise as far as their understanding allows.

Convention de l'Union Africaine sur la Cybersecurite et la Protection des Donnees a Caractere Personnel (Convention de Malabo), adoptee le 27 juin 2014; ratifiee par la RDC par decision du Conseil des ministres du 6 decembre 2022; convention entree en vigueur le 8 juin 2023

• Adopt national data protection legislation that requires informed consent, protects data subject rights, and restricts cross-border data transfers.