Is a listed company, in the Democratic Republic of the Congo

Code du numérique, Livre IV, Titre II, Chapitre I, et Titre III, Chapitre I, Section 1, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 276 et 281) · Read the law's page

• Cooperate in detecting cyberattacks in accordance with the applicable legal and regulatory provisions.
• Inform the Agence Nationale de Cybersécurité of every attack, intrusion or other penetration liable to impair the operation of another information system or network, so as to let the Agency take the measures necessary to address it, including isolating the affected system.
• Comply with the measures the Agence Nationale de Cybersécurité prescribes to put an end to the disruption.
• This binds the operator of an information system, public or private, and more broadly any natural or legal person operating in, or possessing expertise in, the digital sector, without any sector limitation.
• No fixed numerical notification deadline is stated; the duty runs from the operator's own awareness of the attack, intrusion or penetration.

Code du numérique, Titre III, arts. 234, 249 à 261 et Titre IV, arts. 262 à 270 (autorité de protection des données, sanctions et voies de recours) · Read the law's page

• Expect the Data Protection Authority to have exclusive competence over your compliance with Titre III, and to be able to delegate that control only to a body that has shown it independence, expertise, and a conflict-free structure.
• Expect a data subject to be able to complain to the Data Protection Authority, and to have a right of judicial recourse if the Authority does not act on the complaint or tell them its outcome within sixty days.
• Expect a data subject to be able to sue you or your processor before the tribunal de paix, and to be liable, jointly and severally with any other controller or processor participating in the same processing, for material or moral harm the processing caused in violation of Titre III.
• As joint controllers, allocate your respective duties by transparent agreement, including how you will handle a data subject's rights, and make the essence of that agreement available to the data subject.
• Do not obstruct the Data Protection Authority's on-site inspection, and expect a warning or a formal notice giving you no more than eight days to end a breach before a sanction follows.
• Expect an administrative fine of eight million to two hundred million Congolese francs for a violation causing no serious harm, rising to five per cent of your annual turnover where the violation caused death or an attempted murder, or an order to cease processing where it endangered national security or safety or led to a mass crime or genocide, on top of the State's separate right to bring a criminal action.
• Expect the Authority's sanctions to rest on a notified report, to have fifteen days to respond to it, and to be able to appeal a sanction before the competent administrative court; expect the Authority to make its sanctions public.