LexLint.ioBeta

Know the law your code answers to.

Law / Central African Republic

Loi n° 24.001 portant protection des données à caractère personnel

Loi n° 24.001 du 25 janvier 2024 portant protection des données à caractère personnel Chapitres Ier, II, V, VII et IX, articles 1 à 21, 28, 38 à 43, 57 et 58 (dispositions générales, principes, interconnexion des fichiers, délégué à la protection des données et dispositions finales)

In force since .

A comprehensive regime rule binding public and private bodies.

How the hook was established
express
What makes it apply
Operator establishment, Place of effect
Obligation class
Consent, Governance, Security, Retention, Contract terms
Audit expectation
on_request
Who audits it
Regulator
Where the report goes
Produced on request

What it requires

  • Have a lawful basis, such as a contract's performance, a legal obligation, a legitimate interest that does not override the data subject's rights, the data subject's freely given and revocable consent, a vital interest, or a public interest mission, before processing someone's personal data.NIST Privacy FrameworkCT.PO-P1
  • Apply the Act's core principles to every processing activity: lawfulness, fairness, transparency, security, purpose limitation, accuracy, proportionality, and a retention period no longer than the purpose requires.NIST Privacy FrameworkGV.PO-P1
  • Take precautions appropriate to the data's nature and the risks involved to keep personal data secure, including protection against accidental or unlawful destruction, loss, alteration, or unauthorized access.NIST Privacy FrameworkPR.DS-P5
  • Only retain personal data for archival, historical, statistical, or scientific purposes beyond its ordinary retention period under the safeguards a law defines for that purpose.NIST Privacy FrameworkCT.PO-P2
  • Process personal data as a subcontractor only on the controller's instruction, offer sufficient guarantees to implement security and confidentiality measures, and put those obligations in the contract with the controller.NIST Privacy FrameworkID.DE-P3
  • If you provide electronic signature certification services, collect the personal data needed for issuing and keeping the certificates directly from the person concerned, and use it only for that purpose absent the person's express consent otherwise.NIST Privacy FrameworkGV.PO-P1
  • Get the agency's prior authorization before interconnecting personal data files held for different purposes or by different controllers, stating in the request the nature of the data, the interconnection's purpose, and its duration.NIST Privacy FrameworkGV.PO-P5
  • Designate a data protection officer to keep the processing register, review new processing before it starts, consult the agency in case of doubt, and handle data subject requests; only a person residing in the Central African Republic with the necessary qualifications may hold the role, and the agency must be told before the officer is removed.NIST Privacy FrameworkGV.PO-P3

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
  • GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
  • GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
  • GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
  • CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
1 more
  • PR.DS-P5Protections against data leaks are implemented.
NIST CSF 2.0
  • PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
FINOS AIGF
7 more

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Regulator

Logging duty

The register is named but its contents are not, so log contents are empty. The delegate’s annual report of its activities is presented to the controller and kept at the disposal of the agency (English: which it holds at the disposal of the agency in charge of personal data protection); that is the clause behind the regulator’s access and the on-request audit value, and the article does not say the register itself is available to the agency. No period for keeping either is stated. Appointing a delegate exempts the controller from the declaration formalities to the agency, except where the processing needs the agency’s authorization. The scope hook comes from the scope article, Art. 3 on the order of the printed article labels: the Act applies to processing carried out in the activities of an establishment of a controller or processor on the territory (an establishment rule) and to processing that has effects in the Republic, even if they occur abroad or the controller is abroad (an effects rule).

Kind
Explicit
As of
Provision
Art. 38: the controller’s data protection delegate must keep up to date the register of processing operations the controller carries out, and prepare an annual report of its activities that it holds at the agency’s disposal
Trigger
personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Loi n° 24.001 applies to processing carried out by an establishment of a controller or a processor in the Central African Republic, and to processing that produces effects in the country even where the controller is abroad, subject to carve outs for a purely personal or domestic use and for the temporary, intermediate technical copies an access provider makes to route traffic.

Every activity of processing personal data must respect the principles of lawfulness, fairness, transparency, security, purpose limitation, accuracy, proportionality, and retention limitation.

Personal data may be processed only where it is necessary for the performance of a contract, compliance with a legal obligation, a legitimate interest that does not override the data subject's rights, the data subject's freely given and revocable explicit consent, the safeguarding of someone's vital interests, or the performance of a public interest mission, and a person who has made their own data freely accessible supports a controller's reliance on the legitimate interest ground.

Data processed for archival, historical, statistical, or scientific purposes may be kept and used under safeguards a law defines for that purpose even after the Act's ordinary retention limit would otherwise apply. A controller must take precautions appropriate to the data's nature and the risks involved to keep personal data secure, including protection against accidental or unlawful destruction, loss, alteration, or unauthorized access.

Processing may be subcontracted only on the controller's instruction, the processor must offer sufficient guarantees to implement security and confidentiality measures, and the contract between them must specify the processor's security and confidentiality obligations.

A provider of electronic signature certification services must collect the personal data it needs to issue and keep the certificates directly from the person concerned, and use it only for that purpose, absent the person's express consent otherwise.

Interconnecting personal data files held by different public service bodies with different public interests, or held by private parties for different purposes, needs the agency's prior authorization, stating the nature of the data, the purpose the interconnection serves, and its duration.

Every controller must designate a data protection officer responsible for compliance with the Act's obligations, who keeps the register of processing operations, issues an opinion on every new processing operation before it starts, and consults the agency in case of doubt, and designating one exempts the controller from the ordinary prior declaration formalities except where the processing needs the agency's authorization.

Only a person residing in the Central African Republic with the necessary knowledge and qualifications may be designated data protection officer, whether an employee or an outside person, and the officer may be removed only for serious cause and after the agency has been told.

Chapitre Ier defines a violation of personal data as any destruction, loss, alteration, or unauthorized disclosure of personal data, transmitted, stored, or otherwise processed, that is accidental or unlawful, but no provision of the Act requires that violation to be notified to the agency or to the person concerned. The Act states that it takes effect from its date of promulgation, and the President promulgated it at Bangui on .

When LexLint raises it

When your app profile says your app ships a mobile app or processes personal data.

Back to the example  ·  Lint your app

Page updated .