Law / 
Democratic Republic of the Congo
Digital Code, Livre II: Trust Service Provider Security-Incident Notification
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
What it requires
- This binds a qualified or non-qualified trust service provider (prestataire de services de confiance), an electronic certification service provider, regardless of whether it is public or private.
- Notify the Autorité Nationale de Certification Électronique, and where applicable other bodies concerned, within twenty four hours of becoming aware of it, of every breach of security or loss of integrity having a significant impact on the trust service provided or on the personal data it stores.
- Where the breach or loss of integrity is liable to harm a user of the service, notify that user as well, within twenty four hours.
- Expect the Autorité Nationale de Certification Électronique to be able to require you to inform the public of the breach, or to inform the public itself, whenever it finds the public interest requires it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 164 frames the sanction for a trust service provider's noncompliance with the ordonnance-loi, including the Article 148 and 149 notification duties, as an administrative one (a fine, a service suspension, or a prohibition on operating), not a criminal offense; the section carrying Article 164 is captioned Des sanctions administratives.
Penalty structure
Article 164 tiers the administrative sanction on a trust service provider by the impact of the breach: a suspension of service for ninety to three hundred sixty five days and/or a fine of 500,000 to 5,000,000 Congolese francs where the impact is limited to the certificate holder, a fine of 10,000,000 to 50,000,000 Congolese francs where the impact touches the integrity of holders' personal data, and a prohibition on operating in the Democratic Republic of the Congo where the breach touches national defense or state security. Article 164 applies to a trust service provider's noncompliance with the ordonnance-loi generally, including the Article 148 and 149 notification duties, and is not confined to those two articles.
- Rule
- Fixed only
- As of
- Minimum
- 500,000
- Currency
- CDF
- Fixed cap
- 50,000,000
Who enforces it
Enforcement body
L'Autorité Nationale de Certification Électronique.
Settledness
- As of
- Open questions
- What form must the Article 148 notification to the Autorité Nationale de Certification Électronique take beyond the statute's own "par tout moyen" (by any means) wording?
What this law does
Article 148 requires a qualified or non-qualified trust service provider to notify the Autorité Nationale de Certification Électronique, and where applicable other bodies concerned, within twenty four hours of becoming aware of it, of every breach of security or loss of integrity having a significant impact on the trust service provided or on the personal data it stores.
Article 149 requires the trust service provider to notify the same breach or loss of integrity to an affected user within twenty four hours where it is liable to harm that user. Article 149 requires the Autorité Nationale de Certification Électronique, on receiving a notification concerning a foreign State, to inform the competent authorities of that State beforehand.
Article 149 lets the Autorité Nationale de Certification Électronique inform the public of the breach, or require the trust service provider to do so, whenever the Authority finds the public interest requires it.
When LexLint raises it
When your app profile says your app runs an essential service.
Back to the example · Lint your app
Page updated .