Makes education decisions, in the Central African Republic

Loi n° 24.001 du 25 janvier 2024, Chapitre II et Chapitre VI, articles 11 à 21 et 29 à 37 (droits liés au traitement, prospection directe) · Read the law's page

• Get a person's prior consent before contacting them with direct marketing by phone, fax, SMS, email, instant message, or social network, and let them unsubscribe or change their preferences at any time.
• Give every marketing communication, including one sent to a business or a professional contact, a notice and an unsubscribe mechanism as simple and effective as the original sign up.
• On request, give a person access to their data and to information about how any automated decision producing legal effects for them was reached, so they can understand and contest it.
• Let a person object, at any time and free of charge, to processing of their data where they show a legitimate reason, and answer an access request free of charge, on the spot or remotely, without delay, handing over a copy of the data on request.
• Correct, complete, update, block, or erase personal data on a substantiated request where it is inaccurate, incomplete, ambiguous, outdated, or unlawfully processed, and notify any third party you disclosed it to of the change without delay.
• You may refuse a manifestly abusive, repeated, or systematic request, but carry the burden of proving the abuse if the person disputes your refusal.
• Where a request concerns data processed for State security, defense, or public safety, expect the data protection agency, not the data subject directly, to route the access or rectification request.

Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre II (art. 14, 15 et 25) et Titre III, Chapitre I (art. 43) · Read the law's page

• Submit your networks or information systems to a mandatory security audit and severity-impact assessment by the Agence Nationale de la Cybersécurité at least once a year, or more often where circumstances require it.
• Provide the information and documents a security audit requires, and do not obstruct or resist it: obstructing a security audit is a criminal offense under Article 43.
• This binds a network operator, a certification authority and an electronic-communications service provider by name under Article 14, and Article 25 extends the mandatory security-audit regime to every electronic-communications network and every information system.
• Expect the confidential audit report to reach the Agence Nationale de la Cybersécurité for approval and then the Ministères chargés de la Sécurité Publique and de l'Economie Numérique for decision.

Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre III, Sections I et II (art. 16, 19, 20, 21, 23) · Read the law's page

• This binds an electronic-communications network operator or service provider (Article 16) and any information-system operator, whether public or private (Article 19), regardless of the sector in which the network or system is deployed.
• Take all technical and administrative measures necessary to guarantee the security of the services you offer, and adopt standardized systems to continually identify, assess, treat and manage the risks to your information systems' security.
• Put in place technical mechanisms addressing threats to your systems' permanent availability, integrity, authentication, non-repudiation and data confidentiality, and to their physical security, and submit those mechanisms to the Agence Nationale de la Cybersécurité for approval.
• Periodically evaluate and revise your security systems, and introduce necessary changes as technology evolves, under the Agence Nationale de la Cybersécurité's oversight.
• Inform your users of the dangers of using your network or information system, the particular security-violation risks involved, and the technical means available to secure their communications or restrict access to certain services.