AlbaniaLaw On Electronic Communications, Security of Public Networks and Services
Law No. 54/2024 On Electronic Communications in the Republic of Albania, arts. 54, 56 and 184
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Reporting
As of .
What it requires
- This binds undertakings that provide public electronic communications networks or electronic communications services available to the public in Albania (reached by declaring that you provide telecom services).
- Take appropriate and proportionate technical and organisational measures, including encryption where appropriate, to manage the risks to the security of your networks and services and to prevent and minimise the impact of security incidents on users and on other networks and services (article 54(1)).
- If you provide internet access, take measures to protect your users against DDoS attacks (article 54(2)).
- Notify AKEP and the authority responsible for cybersecurity without delay of a cybersecurity incident that has affected the operation of your networks, systems or services (article 54(3)).
- Give AKEP the information it needs to assess the security of your networks and services, including your documented security policies, and submit the results of a security audit by a qualified independent body or a competent authority, at your own cost (article 56(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 184(1) treats the listed infringements as administrative offences punished with a fine when they do not constitute a criminal offence.
Penalty structure
Article 184(1) point a fines an undertaking that fails to take the article 54 measures up to 3% of its annual revenue in the last closed financial year, and not more than 100,000,000 lek.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 3
Who enforces it
Enforcement body
The Authority of Electronic and Postal Communications (AKEP), which supervises the application of article 54 (article 56(1)).
Settledness
- As of
- Open questions
- Which fine tier of article 184 applies to a failure to notify an incident under article 54(3), which article 184(1) does not list by number?
What this law does
Article 54(1) obliges providers of public electronic communications networks or services available to the public to take appropriate, proportionate technical and organisational measures to manage the risks to the security of networks and services. Article 54(2) obliges internet access providers to take measures to protect against DDoS attacks.
Article 54(3) obliges those providers to notify AKEP and the authority responsible for cybersecurity without delay of a cybersecurity incident that has affected the operation of their networks, systems or services. Article 56(3) point a requires electronic communications undertakings to give AKEP the information it needs to assess the security of their networks and services, including documented security policies.
Article 56(3) point b requires them to submit a security audit by a qualified independent body or a competent authority at their own cost. Article 184(1) point a fines an undertaking up to 3% of its annual revenue in the last closed financial year, and not more than 100,000,000 lek, for the infringements listed under it.
Article 184(1) point a sub-point xii lists among those infringements a failure to take the appropriate, technical, organisational and proportionate measures required by article 54. The law was adopted on and promulgated by decree no. 227 of . Article 193(2) provides that the law enters into force 6 months after publication in the Official Gazette.
When LexLint raises it
When your app profile says your app provides telecom services.