Republic of the CongoCybersecurity Law: Duty to Inform the Agency of Attacks, Intrusions and Disturbances
Loi n° 26-2020 du 5 juin 2020 relative à la cybersécurité, articles 18 et 19
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds every operator of an information system or an electronic communications network, whether a public body or a private organisation; the Law excludes the systems and networks used for national defence and security (Article 2).
- Inform the agency in charge of the security of information systems and networks (defined in Article 3) without delay of any attack, intrusion or other disturbance likely to impede the operation of another information system or electronic communications network; the Law sets the clock as 'without delay' and states no hour limit (Article 18).
- Comply with the measures the agency decides in order to end those disturbances (Article 18).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 39 refers the Law's infractions to the penal code and to the law relating to the fight against cybercrime; Article 18 itself states no penalty for a failure to inform the agency.
Who enforces it
Enforcement body
The agency in charge of the security of information systems and networks, which under Article 19 can order the isolation of the system or network concerned until the disturbances cease.
Settledness
- As of
- Open questions
- Has the agency that Article 3 describes as created by a law been established, and has any text fixed the form of the information Article 18 requires an operator to give it?
What this law does
Article 18 requires every operator of an information system or an electronic communications network, whether a public body or a private organisation, to inform the agency without delay of any attack, intrusion or other disturbance likely to impede the operation of another information system or electronic communications network. Article 18 also requires the operator to comply with the measures the agency decides in order to end those disturbances.
Article 19 lets the agency order the isolation of the information system or electronic communications network concerned until the disturbances cease. Article 19 requires the minister in charge of information and communication technologies to be informed without delay of that isolation. Article 2 excludes from the Law the information systems and electronic communications networks used for national defence and security.
Article 39 provides that infractions of the Law are provided for and punished by the penal code and by the law relating to the fight against cybercrime.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.