Cabo VerdeCybersecurity Regime: Security Measures of Digital Service Providers
Decreto-lei nº 9/2021, arts. 12 and 19 (regime jurídico de cibersegurança)
In force.
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- This binds a digital service provider (prestador de serviços digitais) that offers an online marketplace, an online search engine, cloud computing or another service in the digital economy, and that has its main establishment in Cabo Verde or designates a representative established there (Articles 2(4) and 12); operates_social_platform is flagged here as this vocabulary's nearest available proxy for that class, not as the limit of who the duty reaches.
- Identify and take appropriate and proportionate technical and organisational measures to manage the risks to the security of the networks and information systems you use to offer digital services, at a level of security that suits the risk and the latest technical progress (Article 19(1)-(2)).
- Take account in those measures of the security of systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards (Article 19(2)).
- Take measures to prevent incidents that affect the security of your networks and information systems and to minimise their impact on your digital services (Article 19(3)).
- Tell the Centro Nacional de Cibersegurança immediately when you start your activity, once the Centro has been installed (Article 31).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 23 classifies infractions of the decree-law as contraordenações (administrative offences), which Articles 24 and 25 punish with fines.
Penalty structure
Article 24 punishes a very serious infraction, which includes failing to implement the security requirements of Articles 15, 17 and 19 or failing to follow the instructions of the Centro Nacional de Cibersegurança, with a fine of 150,000$00 to 1,000,000$00 for a legal person and 50,000$00 to 300,000$00 for an individual.
- Rule
- Fixed only
- As of
- Minimum
- 150,000
- Currency
- CVE
- Fixed cap
- 1,000,000
Who enforces it
Enforcement body
The Centro Nacional de Cibersegurança, the national cybersecurity authority, which holds the powers of inspection and of applying sanctions under the decree-law.
Settledness
- As of
- Open questions
- Has the separate regulation that Article 32 required within 150 days of entry into force, which defines the security requirements of Article 19, been issued?
- Has the Centro Nacional de Cibersegurança been installed, since Article 33 starts the sanctions regime of Articles 23 to 28 180 days after its installation?
What this law does
Article 12 defines digital service providers as the providers of an online marketplace service, an online search engine service, a cloud computing service and other services operating in the digital economy. Article 19 requires a digital service provider to identify and take appropriate and proportionate technical and organisational measures to manage the risks to the security of the networks and information systems it uses to offer digital services.
Article 19 requires those measures to take account of the security of systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards.
When LexLint raises it
When your app profile says your app operates a social platform.