Republic of the CongoCybersecurity Law: General Security Duties of Every Operator of an Information System
Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 4 à 11
In force.
A security baseline statutes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds anyone, whether a citizen, a business, an organization or a public authority, that develops, owns, supplies, manages, maintains or uses an information system or network; the Law excludes the systems and networks used for national defense and security (Article 2).
- Take adequate measures to protect against and prevent any risk to third parties arising from your use of information systems and networks (Article 4).
- Be accountable for the security of the systems and networks you develop, own, supply, manage, maintain or use, and continuously review and assess your own security policies, practices, measures and procedures to make sure they fit their environment (Article 4).
- Do everything possible to prevent, detect and respond to security incidents (Article 5).
- Exchange the information you hold on threats to and vulnerabilities of networks and systems in an appropriate manner, and put in place procedures for rapid and effective cooperation to prevent and detect security incidents (Article 6).
- Carry out risk assessments that cover the main internal and external factors, such as technology, physical and human factors, and the policies and services of third parties (Article 8).
- Design, implement and coordinate your information systems and networks to optimize their security, with technical and non-technical protective measures proportionate to the value of the information in them (Article 9).
- Base your security management on the risk assessment, covering every level of your activities and including responses to identifiable or foreseeable threats, the prevention, detection and resolution of incidents, system recovery, permanent maintenance, control and audit (Article 10).
- Guarantee the security of your systems and networks constantly as risks evolve, with continuous risk assessment and appropriate changes to your security policies, practices, measures and procedures (Article 11).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 39 refers the Law's infractions to the penal code and to the law relating to the fight against cybercrime; Articles 4 to 11 themselves state no penalty.
Who enforces it
Enforcement body
Articles 4 to 11 name no enforcing body; Article 39 refers the infractions of the Law to the penal code and to the law relating to the fight against cybercrime.
Settledness
- As of
- Open questions
- Do Articles 4 to 11 carry any sanction of their own, given that Article 9 has the desired degree of digital security reached 'en premier lieu grâce à l’autorégulation' (in the first place through self-regulation) and Article 39 refers infractions to the penal code and the cybercrime law?
What this law does
Article 4 requires anyone who uses information systems and networks, whether a citizen, a business, an organization or a public authority, to take adequate measures to protect against and prevent any risk to third parties arising from that use.
Article 4 makes anyone who develops, owns, supplies, manages, maintains or uses information systems and networks responsible and accountable for their security, and bound to review and assess continuously its own security policies, practices, measures and procedures. Article 5 requires the same persons to do everything possible to prevent, detect and respond to security incidents.
Article 6 requires users and holders of information systems and networks to exchange the information they hold on threats to and vulnerabilities of those networks and systems in an appropriate manner. Article 8 requires anyone who makes or holds information systems to carry out risk assessments. Article 9 requires the protective measures and solutions adopted to be both technical and non-technical and proportionate to the value of the information in the organization's systems and networks.
Article 10 provides that security management is based on risk assessment. Article 11 requires users and holders of information systems and networks to guarantee their security constantly in the face of evolving risks. Article 39 provides that infractions of the Law are provided for and punished by the penal code and by the law relating to the fight against cybercrime.
Article 2 excludes from the Law the information systems and electronic communications networks used for national defence and security.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.