BeninLoi n°2017-20 portant Code du Numérique en République du Bénin, Livre V, notification des ruptures de sécurité
Loi n°2017-20 du 20 avril 2018, Livre V, art. 427 (notification des ruptures de sécurité)
In force.
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the Autorité de Protection des Données Personnelles (APDP) and the affected person without delay of any security breach that has affected their personal data.
- As a processor, warn the controller without delay of any security breach affecting personal data you process on the controller's behalf.
- Describe in the breach notification the nature of the breach, including where possible the categories and approximate number of affected data subjects and personal data records, your data protection contact point, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.
- Skip notifying the affected person only where you had already applied protective measures such as encryption that make the data unintelligible, where later measures removed the high risk, or where it would take disproportionate effort and you make an equally effective public communication instead.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 427 requires the controller to notify the Autorité and the person without delay of a security breach, and a processor to warn the controller, with the content the notice must carry. It asks for a notification only and does not make the controller document or keep a record of breaches. The row cites no territorial clause.
- Kind
- None
- As of
What this law does
Article 427 requires a controller to notify the Autorité de Protection des Données Personnelles (APDP) and the affected person without delay of any security breach that has affected their personal data, and requires a processor to warn the controller without delay of any breach affecting data it processes on the controller's behalf.
The notification must describe the nature of the breach, including where possible the categories and approximate number of affected data subjects and personal data records, the contact point for more information, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.
Article 427 excuses notice to the affected person only where the controller had already applied protective measures such as encryption that make the data unintelligible, where later measures removed the high risk, or where it would take disproportionate effort and the controller makes an equally effective public communication instead. The Book states no fixed number of hours or days for either notification, so both run only from becoming aware of the breach and without delay.
The Digital Code states no day of entry into force, and no Journal officiel publication of it and no other source stating the day it came into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .