Runs an essential service, in Djibouti

Code Numérique, Livre Premier, Arts. 14 et 15 (notification des atteintes à la sécurité) · Read the law's page

• Notify the Commission Nationale de Protection des Données à Caractère Personnel of a personal-data breach without undue delay and, at the latest, within 72 hours of becoming aware of it, stating the reasons for any delay beyond that window.
• Tell the affected individual of the breach without undue delay, in clear and simple terms, where it is likely to result in a high risk to their rights and freedoms.
• As a processor, notify the controller of a personal-data breach without undue delay after becoming aware of it.
• Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned, the contact point, the likely consequences, and the measures taken or proposed to address it, and supply the information in stages where it cannot all be given at once.
• Keep a register of every personal-data breach, its facts, its effects and the remedial measures taken, and make it available to the Commission on request.

Loi n° 195/AN/25/9ème L portant création de l’Autorité Nationale de Cybersécurité, Art. 13 · Read the law's page

• Applies to a public or private operator that manages an infrastructure of vital importance, that is an installation, system or service whose unavailability would gravely compromise national security, the economy or public health.
• Notify without delay any security incident liable to affect the continuity of service of your infrastructure of vital importance for more than four consecutive hours, or compromising the integrity of sensitive data.
• Cooperate in the investigations that follow a major incident.

Loi n° 195/AN/25/9ème L portant création de l’Autorité Nationale de Cybersécurité, Arts. 9, 12 et 13 · Read the law's page

• Applies to a public or private operator that manages an infrastructure of vital importance, that is an installation, system or service whose unavailability would gravely compromise national security, the economy or public health. The National Cybersecurity Authority identifies the initial list of these operators and proposes it to the Government.
• Implement the security measures the National Cybersecurity Authority prescribes for operators of vital importance.
• Apply the corrective measures the Authority orders where it finds a critical vulnerability.
• In a major cyber crisis that constitutes a grave and imminent threat to national security, apply the proportionate technical measures the Authority imposes on operators of vital importance for the length of the crisis.