Runs an essential service, in Monaco

Loi n° 1.435 du 8 novembre 2016, Titre III, arts. 26 à 29, et arrêté ministériel n° 2018-1053, arts. 1er à 3-1 · Read the law's page

• This binds a vital-importance operator (opérateur d'importance vitale), a public or private operator designated as being of vital importance because it is active in a sector essential to Monaco's institutions, public services or economic activity, or because it operates establishments or installations whose unavailability would risk significantly affecting those interests; it is reached by declaring that you operate an essential service.
• Apply, at your own expense, the security rules that the Minister of State sets by arrêté ministériel for the protection of your information systems (Article 28 of the Loi).
• Draw up, keep current and implement an information-systems security policy that covers your vital information systems, and carry out the security accreditation of each of them (Annex I, rules 1 and 2, of Arrêté ministériel n° 2018-1053).
• Send the Agence Monégasque de Sécurité Numérique, within three months of your designation, the list of your vital information systems with the declaration form for each (Article 2 of that arrêté).
• Send the Agency each year the updates to that list and, by 31 December, the tables assessing the security level of each vital information system (Articles 3 and 3-1 of that arrêté).
• When the Minister of State asks, submit your information systems to the checks that the Agency carries out to verify the level of security and compliance with the rules, at your own cost (Article 28 of the Loi).

Loi n° 1.435 du 8 novembre 2016, art. 28 (incidents), et arrêté ministériel n° 2018-1053, arts. 4 à 4-2 · Read the law's page

• This binds the same vital-importance operators as the security regime of Articles 26 to 29 of the Loi: an operator designated as being of vital importance, reached by declaring that you operate an essential service.
• Notify the Agence Monégasque de Sécurité Numérique without delay of any incident with a significant impact on the service your vital information system provides, on the Annex III declaration form (Article 4 of Arrêté ministériel n° 2018-1053): send an early warning within 24 hours of becoming aware of the incident, an incident notification within 72 hours, an interim report when the Agency asks for one, and a final report no later than one month after the incident notification (Annex III).
• Inform the Minister of State without delay of incidents affecting the functioning or security of your information systems (Article 28 of the Loi).
• Tell the recipients of your services who are potentially affected by a significant cyber threat, without delay, of the measures or corrections they can apply in response, and of the threat itself (Article 4).
• Notify the Direction de la Sûreté Publique without delay, with the technical evidence of compromise, where there is reason to suspect that the incident originates in an offence under the Code pénal (Article 4-1).

Loi n. 1.565 du 3 decembre 2024, art. 32 (personal data breach notification) · Read the law's page

• Notify the Authority of a personal data breach as soon as possible and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to create a risk to the rights and freedoms of the persons concerned, and give the reasons for the delay when you notify later than that.
• Communicate a personal data breach to the affected person as soon as possible, in clear language, when it is likely to create a high risk to their rights and freedoms.
• As a processor, notify the controller of a personal data breach as soon as you become aware of it.
• Describe in the notification to the Authority the nature of the breach, including where possible the categories and approximate number of affected persons and records, a contact point, the likely consequences, and the measures taken or proposed to address it.
• Document every personal data breach, its facts, its effects, and the remedial steps you took, and expect the Authority to be able to require you to communicate the breach to the affected person if you have not already done so.