Operates a social platform, in Cabo Verde

Decreto-lei nº 9/2021, arts. 12 and 19 (regime jurídico de cibersegurança) · Read the law's page

• This binds a digital service provider (prestador de serviços digitais) that offers an online marketplace, an online search engine, cloud computing or another service in the digital economy, and that has its main establishment in Cabo Verde or designates a representative established there (Articles 2(4) and 12); the duty reaches that whole class, not only social platforms.
• Identify and take appropriate and proportionate technical and organisational measures to manage the risks to the security of the networks and information systems you use to offer digital services, at a level of security that suits the risk and the latest technical progress (Article 19(1)-(2)).
• Take account in those measures of the security of systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards (Article 19(2)).
• Take measures to prevent incidents that affect the security of your networks and information systems and to minimise their impact on your digital services (Article 19(3)).
• Tell the Centro Nacional de Cibersegurança immediately when you start your activity, once the Centro has been installed (Article 31).

Decreto-lei nº 9/2021, arts. 20 and 31 (regime jurídico de cibersegurança) · Read the law's page

• This binds a digital service provider (prestador de serviços digitais) that offers an online marketplace, an online search engine, cloud computing or another service in the digital economy, and that has its main establishment in Cabo Verde or designates a representative established there (Articles 2(4) and 12); the duty reaches that whole class, not only social platforms.
• Notify the Centro Nacional de Cibersegurança of incidents with a substantial impact on the provision of your digital services, in the shortest period possible for handling the data (Article 20(1)).
• Weigh whether an incident's impact is substantial by the number of users affected, the duration, the geographic spread, the severity of the disruption to the service and the extent of the impact on economic and societal activities (Article 20(4)).
• Include in the notification the information that lets the Centro determine the importance of cross-border impacts (Article 20(2)).
• Notify an incident only where you have access to the information needed to assess its impact against those parameters (Article 20(5)).