Operates a social platform, in Albania

Law No. 25/2024 (Ligj Nr. 25/2024), 21 March 2024, "Për sigurinë kibernetike" ("On Cybersecurity"), Fletorja Zyrtare No. 67/2024, p. 7767 · Read the law's page

• Register your critical or important information infrastructure with the National Authority for Cybersecurity (AKSK), establish a Computer Security Incident Response Team and a single point of contact for AKSK and other CSIRTs, and implement the technical, organisational and operational risk management measures a Council of Ministers methodology sets for your designated category.
• Report a significant or substantial cybersecurity incident to AKSK and the relevant CSIRTs, and inform the public or affected users where the incident reaches them; cooperate with AKSK and other operators in sharing cybersecurity threat, vulnerability and incident information. AKSK's own incident categorisation and log retention regulations set the reporting clock and severity thresholds that apply to your designated category.
• Where your organisation processes personal data in the course of these duties, do so under Albania's personal data protection legislation; this law's security measures duty is separate from, and does not substitute for, a breach notification duty to Albania's data protection authority under Law No. 124/2024.
• This binds a subject named in Annexes I or II of the law as administering a critical or important information infrastructure; the National Authority for Cybersecurity's own presentation of those Annexes lists digital service providers among the sectors reached, alongside energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, business to business ICT service management, public administration, space, education, tourism, postal and courier services, waste management, chemicals, food and manufacturing; the digital service provider class is reached as such, and the other named sectors are reached too, by declaring that you are an essential or important entity.

Law No. 25/2024 On Cybersecurity, arts. 23, 26(3) and 44-45 · Read the law's page

• This binds the public and private subjects named in Annexes I and II of the law that the National Authority for Cybersecurity (AKSK) identifies as operators of critical or important information infrastructure under article 12, among them energy, transport, banking, health, public electronic communications, ICT service management and, in Annex II, digital service providers (reached by declaring that you are an essential or important entity). Article 50(1) gave subjects 24 months from the law's entry into force on 3 May 2024 to harmonise their activity with it.
• Report every type of cybersecurity incident to the National CSIRT and your sectoral CSIRT within 4 hours of identifying the incident (article 23(3)).
• For a significant incident, within 72 hours of identifying it update the information you reported and give an initial assessment of the incident, including its severity and impact and, where there are any, indicators of compromise (article 23(3)).
• Within one month after notifying the incident, submit a final report to the National CSIRT that describes the incident and its impact, the type of threat or main cause, the measures applied and continuing, and any cross-border impact; for an ongoing incident also submit a progress report while it lasts (article 23(5) and (6)).
• Notify without delay the users of your services who may be affected by a significant cybersecurity incident, telling them what measures they can take in response (article 26(3)).
• Cooperate with the National CSIRT and your sectoral CSIRT in every phase of a cybersecurity incident on your information infrastructure (article 23(2)).