Republic of the CongoLaw No. 29-2019, personal-data breach notification
Loi n° 29-2019, articles 74 à 78 (violation de données à caractère personnel)
In force.
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the national commission of a personal-data breach without undue delay and, where possible, within 72 hours of becoming aware of it, unless the breach is not likely to create a risk to the rights and freedoms of natural persons.
- Communicate the breach to the affected data subject without undue delay, in clear and simple terms, where it is likely to create a high risk to their rights and freedoms.
- As a processor, notify the controller of any personal-data breach without undue delay after becoming aware of it.
- Put in the notification to the commission the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned, the contact point, the likely consequences, and the measures taken or proposed to remedy it and mitigate its effects.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 76 requires the controller to document every personal-data breach, stating the facts, its effects and the measures taken to remedy it, so that the commission can verify compliance with the Law. The documented items are outside the closed list of log contents, and no retention period is set. Articles 74, 75, 77 and 78 govern notification of the commission within 72 hours where possible and communication to the data subject, which are reports and not a kept record.
- Kind
- Explicit
- As of
- Provision
- Article 76 (the controller documents every personal-data breach)
- Trigger
- security_incident
What this law does
Article 74 requires the controller, in the case of a personal-data breach, to notify the national commission without undue delay and, where possible, within seventy-two hours of becoming aware of it, unless the breach is not likely to create a risk to the rights and freedoms of natural persons, and to accompany a notification made after that deadline with the reasons for the delay; the processor notifies the controller of any personal-data breach without undue delay after becoming aware of it.
Article 75 fixes what the notification to the commission must contain: the nature of the breach, including where possible the categories and approximate number of data subjects and of personal-data records concerned, the name and contact details of the data protection officer or another contact point, the likely consequences, and the measures taken or proposed to remedy the breach and mitigate its adverse effects, communicated in stages without further undue delay where they cannot all be given at once.
Article 76 requires the controller to document every personal-data breach, its effects and the remedial measures taken, so the commission can verify compliance. Article 77 requires the controller, where a personal-data breach is likely to create a high risk to the rights and freedoms of a natural person, to communicate the breach to the data subject without undue delay, in clear and simple terms, and to give at least the information Article 75 requires.
Article 78 excuses that communication where the controller had applied protective measures, such as encryption, rendering the affected data unintelligible, where later measures mean the high risk is no longer likely to materialise, or where it would take disproportionate effort, in which case a public communication of equal effect is made instead.
Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on . The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, , and no provision of the Law defers its own entry into force to a later date, though no source stating the day on which the Law came into force has been located.
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .