Runs an essential service, in Benin

Loi n°2017-20 du 20 avril 2018, Livre III, Titre I, art. 308, et Titre II, arts. 317-319, portant Code du Numérique en République du Bénin · Read the law's page

• This binds a qualified or non-qualified trust service provider (prestataire de services de confiance), under Article 308, and a qualified provider under the audit rules of Articles 318 and 319; you are reached by declaring that you operate an essential service.
• Take the technical and organisational measures necessary to prevent and manage the risks to the security of the trust services you provide, at a level of security proportionate to the degree of risk (Article 308).
• Take measures to prevent and limit the consequences of security incidents and to inform the parties concerned of their harmful effects (Article 308).
• If you are a qualified provider, undergo an audit by a conformity assessment body, at your own expense, at least every 24 months, and send the conformity assessment report to the control body within three working days of receiving it (Article 318).
• If you are a qualified provider, submit to a further audit or conformity assessment at any time at the control body's request, at your own expense (Article 319).

Loi n°2017-20 du 20 avril 2018, Livre III, Titre I, arts. 309-310, portant Code du Numérique en République du Bénin · Read the law's page

• This binds a qualified or non-qualified trust service provider (prestataire de services de confiance), the same provider the security-measures duty of Article 308 binds; you are reached by declaring that you operate an essential service.
• Notify the control body, and where applicable the other bodies concerned, as soon as possible and at the latest within 24 hours of becoming aware of it, of any breach of security or loss of integrity having a significant impact on the trust service you provide or on the personal data kept in it (Article 309).
• Where the breach or loss of integrity is liable to harm a user of the trust service, notify that user as well, as soon as possible (Article 310).
• Inform the public of the breach or loss of integrity when the control body requires you to do so because it finds the public interest requires it (Article 310).