Runs an essential service, in Gabon

Loi N° 027/2023 du 11 juillet 2023, Titre III, Chapitre Ier, arts. 9-18 et 35 · Read the law's page

• This binds the operator of an infrastructure or a service that a classification decree designates as critical, in the sovereign, human, economic and technological domains (Article 11); you are reached by declaring that you operate an essential service.
• Draw up, from a risk analysis, the list of your sensitive information systems and send it, with each update, to the competent administrative authority; amend the list as that authority's observations require and send it again within the period a regulation sets (Article 12).
• Take all useful measures to organise and ensure the security of the critical infrastructure, on the conditions and terms a regulation sets (Article 13).
• Draw up a plan of protection measures, including monitoring, alert and physical protection devices that keep the infrastructure permanently operational, and submit it to the competent administrative authority for approval (Articles 14 to 16).
• Carry out an approved plan within the period the authority sets, and have the effective carrying out of the measures certified as to security (Articles 16 and 17).
• Apply the common information-system security duties of Articles 28 to 34 as well, subject to any more demanding security measures a regulation sets, since Article 35 extends that section to critical-infrastructure operators.

Loi n°025/2023, articles 142 à 147 (violation de données à caractère personnel) · Read the law's page

• Notify the APDPVP without delay of a personal-data breach, describing its nature, the categories and approximate number of data subjects and records concerned where possible, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to address it; the law sets no numeric deadline for this notice.
• Accompany a notification to the APDPVP with supporting evidence of the breach.
• As a processor, notify the controller without delay of a personal-data breach as soon as you become aware of it.
• Where a breach is likely to create a high risk to a person's rights and freedoms, inform the affected person as soon as possible, in clear and simple terms, giving at least the same information given to the APDPVP.
• Skip that communication to the person only where you had already applied protective measures rendering the affected data unintelligible, where later measures mean the high risk is no longer likely to materialize, or where it would take disproportionate effort, in which case make a public communication of equal effect instead; expect the APDPVP to be able to compel direct communication anyway after weighing the breach's gravity.
• Keep an up-to-date register of every personal-data breach, its circumstances, its impact and the remedial measures taken, and make it available to the APDPVP.