Law / 
Central African Republic
Loi n° 24.001 portant protection des données à caractère personnel, sanctions et agence
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- none
What it requires
- Comply with an administrative sanction the agency imposes for a breach of the Act, a warning, an order to stop processing, a pecuniary sanction of up to 5 percent of your turnover, or withdrawal of an authorization or certification, doubled on repeat conduct.
- Expect the agency to order an urgent interruption of your processing for up to three months, or to lock the data concerned for up to three months where the processing serves State security, defense, or public safety, whenever it violates the rights and freedoms the Act protects, and expect it to seek a court order under an emergency referral for a grave and immediate breach.
- Respond to the agency's report before any sanction, in writing or orally and represented if you choose, and expect a reasoned, published decision you may appeal to the administrative courts, at your cost if you are sanctioned.
- Expect criminal liability, from six months to five years' imprisonment and a fine of 100,000 to 10,000,000 FCFA depending on the offence, for obstructing the agency, negligent processing without required prior formalities, fraudulent collection, misusing a file's declared purpose, continuing to process despite a valid objection or rectification request, unlawful retention beyond the declared duration, or an unauthorized disclosure harming a person's standing or privacy.
- Expect the Ministry in charge of the digital economy to perform the agency's supervisory functions until the dedicated agency is formally established, within twelve months of the Act's promulgation.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Chapitre VIII, Section 2 sets several tiers: six months to five years' imprisonment and a fine of FCFA 100,000 to 5,000,000 for obstructing the data protection agency; six months to two years and FCFA 100,000 to 2,000,000 for negligent processing without required formalities or for unlawful retention beyond the declared duration; two to five years and FCFA 1,000,000 to 10,000,000 for fraudulent collection, misusing a file's declared purpose, processing despite a valid objection or rectification request, or a disclosure harming a person's standing or privacy. The Act states that only the administrative pecuniary sanction under Section 1 is doubled on repeat conduct; it does not state that the criminal fines double.
Penalty structure
Administrative pecuniary sanction the data protection agency may impose for a breach of the Act (Chapitre VIII, Section 1), doubled on repeat conduct; separate fixed criminal fines and imprisonment apply under Section 2 for specific offences (see the criminal exposure note). No fixed monetary cap is stated for the turnover based fine.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 5
Who enforces it
Enforcement body
Agence en charge de la protection des données à caractère personnel (interim oversight resting with the Ministry in charge of the digital economy pending the agency's formal constitution)
What it makes you log
Logging duty
Chapters VIII and IX let the agency impose a warning, an order to stop processing, a pecuniary sanction or withdrawal of an authorization, on a written report notified to the controller, and set criminal penalties and the interim role of the Ministry. The only record clause is that every sanction the agency pronounces is entered in a register, which is the agency’s own record of its decisions and sets no duty on a controller or processor to make, keep or produce a log or record; so the instrument is read as imposing none on the regulated party. Keeping personal data beyond the period in the prior declaration is an offence, and that is a limit on the data and not a record period. The register of processing is in the delegate article, coded on the general row.
- Kind
- None
- As of
What this law does
The agency may impose against a controller, for a breach of one or more provisions of the Act, a warning, an order to stop the processing, a pecuniary sanction, or the withdrawal of a granted authorization or certification.
In an emergency, where a processing activity or the exploitation of data violates the rights and freedoms the Act's opening articles protect, the agency may order the interruption of the processing for up to three months, or lock certain data for up to three months where the processing serves only State security, national defense, or public safety purposes.
A pecuniary sanction is doubled on repeat conduct, and where the breach is grave and immediate the agency may ask the competent court, by way of an emergency referral, to order any security measure the rights and freedoms require. A sanction is decided on the basis of a report, gives the controller a chance to make written and oral observations and be represented, and results in a reasoned, published decision the controller may appeal to the administrative courts, at the sanctioned party's cost.
The pecuniary sanction cannot exceed 5 percent of the controller's turnover, excluding tax, for the last closed financial year, and is recovered like a debt owed the State.
Separate criminal penalties apply, from six months to five years' imprisonment and a fine of 100,000 to 10,000,000 FCFA depending on the offence, for obstructing the agency's missions, for negligently processing personal data without observing the Act's required prior formalities, for retaining data beyond the duration declared to the agency outside an historical, statistical, or scientific exception, for collecting data by a fraudulent, unfair, or unlawful means, for misusing a file's declared purpose, for continuing to process despite a person's well founded objection or rectification request, or for an unauthorized disclosure that harms a person's standing or the privacy of their life.
A court may order the erasure of data involved in an offence, and the agency's members and agents are empowered to establish that the erasure took place. The Ministry in charge of the digital economy has twelve months from the Act's promulgation to establish the dedicated agency, and performs the agency's functions itself in the meantime. The Act states that it takes effect from its date of promulgation.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .