Is a listed company, in the Central African Republic

Loi n° 24.001 du 25 janvier 2024, Chapitre VIII et Chapitre IX, articles 44 à 58 (sanctions et agence) · Read the law's page

• Comply with an administrative sanction the agency imposes for a breach of the Act, a warning, an order to stop processing, a pecuniary sanction of up to 5 percent of your turnover, or withdrawal of an authorization or certification, doubled on repeat conduct.
• Expect the agency to order an urgent interruption of your processing for up to three months, or to lock the data concerned for up to three months where the processing serves State security, defense, or public safety, whenever it violates the rights and freedoms the Act protects, and expect it to seek a court order under an emergency referral for a grave and immediate breach.
• Respond to the agency's report before any sanction, in writing or orally and represented if you choose, and expect a reasoned, published decision you may appeal to the administrative courts, at your cost if you are sanctioned.
• Expect criminal liability, from six months to five years' imprisonment and a fine of 100,000 to 10,000,000 FCFA depending on the offence, for obstructing the agency, negligent processing without required prior formalities, fraudulent collection, misusing a file's declared purpose, continuing to process despite a valid objection or rectification request, unlawful retention beyond the declared duration, or an unauthorized disclosure harming a person's standing or privacy.
• Expect the Ministry in charge of the digital economy to perform the agency's supervisory functions until the dedicated agency is formally established, within twelve months of the Act's promulgation.

Loi n° 24.002 relative à la cybersécurité et à la lutte contre la cybercriminalité, Titre II, Chapitre II (art. 14, 15 et 25) et Titre III, Chapitre I (art. 43) · Read the law's page

• Submit your networks or information systems to a mandatory security audit and severity-impact assessment by the Agence Nationale de la Cybersécurité at least once a year, or more often where circumstances require it.
• Provide the information and documents a security audit requires, and do not obstruct or resist it: obstructing a security audit is a criminal offense under Article 43.
• This binds a network operator, a certification authority and an electronic-communications service provider by name under Article 14, and Article 25 extends the mandatory security-audit regime to every electronic-communications network and every information system.
• Expect the confidential audit report to reach the Agence Nationale de la Cybersécurité for approval and then the Ministères chargés de la Sécurité Publique and de l'Economie Numérique for decision.