Runs an essential service, in the Democratic Republic of the Congo

Code du numérique, Livre II, Titre II, Chapitre III, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 147, et art. 164 pour les sanctions) · Read the law's page

• This binds a qualified or non-qualified trust service provider (prestataire de services de confiance), an electronic certification service provider, regardless of whether it is public or private.
• Take the technical and organizational measures necessary to prevent and manage the risks to the security of the trust services you provide, keeping the level of security proportional to the degree of risk given technological developments.
• Prevent and limit the consequences of security incidents, inform the parties concerned of the harmful effects of such incidents, and ensure the continuity of your services in the event of technical failures or cessation of activity.

Code du numérique, Livre II, Titre II, Chapitre III, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 148 et 149) · Read the law's page

• This binds a qualified or non-qualified trust service provider (prestataire de services de confiance), an electronic certification service provider, regardless of whether it is public or private.
• Notify the Autorité Nationale de Certification Électronique, and where applicable other bodies concerned, within twenty four hours of becoming aware of it, of every breach of security or loss of integrity having a significant impact on the trust service provided or on the personal data it stores.
• Where the breach or loss of integrity is liable to harm a user of the service, notify that user as well, within twenty four hours.
• Expect the Autorité Nationale de Certification Électronique to be able to require you to inform the public of the breach, or to inform the public itself, whenever it finds the public interest requires it.

Code du numérique, Livre IV, Titre II, Chapitre I, et Titre III, Chapitre I, Section 1, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 276 et 281) · Read the law's page

• Cooperate in detecting cyberattacks in accordance with the applicable legal and regulatory provisions.
• Inform the Agence Nationale de Cybersécurité of every attack, intrusion or other penetration liable to impair the operation of another information system or network, so as to let the Agency take the measures necessary to address it, including isolating the affected system.
• Comply with the measures the Agence Nationale de Cybersécurité prescribes to put an end to the disruption.
• This binds the operator of an information system, public or private, and more broadly any natural or legal person operating in, or possessing expertise in, the digital sector, without any sector limitation.
• No fixed numerical notification deadline is stated; the duty runs from the operator's own awareness of the attack, intrusion or penetration.