Bosnia and HerzegovinaRepublika Srpska Law on Information Security, Security Measures for Republic Bodies and Those Handling Their Data
Republika Srpska Law on Information Security, arts. 2, 4-9 and 12-13
In force.
A sector security regimes rule binding public and private bodies.
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the republic bodies of Republika Srpska (the entity of Bosnia and Herzegovina, not the state), its local self-government bodies and legal entities exercising public authority, and any other legal or natural person that accesses or handles their data in electronic form; it does not apply where other laws prescribe the use of paper documents, or to data whose security is governed by the rules on classified data (article 2).
- Apply the information security measures that the Government of Republika Srpska sets, which are general rules giving basic protection of data at the physical, technical and organisational level, in line with the information security standards that the minister of science and technology adopts by rulebook (articles 4 and 5).
- Cover physical protection of buildings, premises and devices that hold data, protection of data (rules for handling data, records of accesses and security oversight) and protection of the information system (articles 6 to 9).
- Follow the coordination of the CERT of the Agency for the Information Society when a computer security incident occurs on your information system (article 12).
- Give the supervising ministry and the Agency access to premises, computer equipment and devices, and provide without delay the data and documentation they need for supervision (article 13(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Ministry of Science and Technology of Republika Srpska supervises the application of the law, and the Agency for the Information Society of Republika Srpska performs expert supervision (article 13(1)).
Settledness
- As of
- Open questions
- Has Republika Srpska amended or replaced the Law on Information Security published in its Official Gazette number 70/11, and which publication date and commencement day apply (article 18 sets the eighth day after publication)?
What this law does
Article 2(1) applies the law to republic bodies, local self-government bodies, legal entities exercising public authority, and other legal and natural persons that access or handle their data in electronic form. Article 4 provides that information security measures are general rules giving basic protection of data at the physical, technical and organisational level, which the Government of Republika Srpska sets.
Article 5(2) has the minister of science and technology adopt a rulebook on information security standards on the proposal of the Agency for the Information Society. Article 6(2) makes the information security measures cover physical protection, data protection and protection of the information system. Article 12 has the CERT of the Agency coordinate the conduct of the bodies and persons concerned when a computer security incident occurs.
Article 13(1) makes the Ministry of Science and Technology responsible for supervising the application of the law and the Agency responsible for expert supervision. Article 13(2) obliges the bodies and persons concerned to give the supervisors access to premises, computer equipment and devices and to provide without delay the data and documentation needed for supervision.
The Rulebook on information security standards cites the law as published in the Official Gazette of Republika Srpska number 70/11.