Handles health records, in the Central African Republic

Loi n° 24.001 du 25 janvier 2024, Chapitre Ier Section 2 et Chapitre II, articles 11 à 21 (données sensibles et mineurs) · Read the law's page

• Get a data subject's explicit consent, and apply extra security and organisational safeguards, before processing a sensitive category of data such as racial origin, biometric or genetic data, health data, or political, religious, or trade union information.
• Get authorisation from a holder of parental responsibility before processing a minor's personal data, including for a direct offer of information society services to a child.
• Do not process sensitive data at all unless a listed derogation applies: the person's express consent unless a law bars it, safeguarding a life, a non profit body's own member processing for its religious, philosophical, political, or trade union purpose, establishing or defending a legal claim, health care or public interest health research, data the person made public, a law authorizing a public interest purpose, or a labor law right or obligation.
• Restrict processing of data about a person's offences, convictions, or safety measures to courts and public authorities acting within their legal powers, and to legal auxiliaries strictly for the duties assigned to them by law.
• When a processing activity involves sensitive data or a particularly vulnerable person's data, put additional organizational and technical safeguards in place and give that person heightened information before you process it.

Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre II (art. 14, 15 et 25) et Titre III, Chapitre I (art. 43) · Read the law's page

• Submit your networks or information systems to a mandatory security audit and severity-impact assessment by the Agence Nationale de la Cybersécurité at least once a year, or more often where circumstances require it.
• Provide the information and documents a security audit requires, and do not obstruct or resist it: obstructing a security audit is a criminal offense under Article 43.
• This binds a network operator, a certification authority and an electronic-communications service provider by name under Article 14, and Article 25 extends the mandatory security-audit regime to every electronic-communications network and every information system.
• Expect the confidential audit report to reach the Agence Nationale de la Cybersécurité for approval and then the Ministères chargés de la Sécurité Publique and de l'Economie Numérique for decision.