Cabo VerdeCybersecurity Regime: Incident Notification by Digital Service Providers
Decreto-lei nº 9/2021, arts. 20 and 31 (regime jurídico de cibersegurança)
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- This binds a digital service provider (prestador de serviços digitais) that offers an online marketplace, an online search engine, cloud computing or another service in the digital economy, and that has its main establishment in Cabo Verde or designates a representative established there (Articles 2(4) and 12); operates_social_platform is flagged here as this vocabulary's nearest available proxy for that class, not as the limit of who the duty reaches.
- Notify the Centro Nacional de Cibersegurança of incidents with a substantial impact on the provision of your digital services, in the shortest period possible for handling the data (Article 20(1)).
- Weigh whether an incident's impact is substantial by the number of users affected, the duration, the geographic spread, the severity of the disruption to the service and the extent of the impact on economic and societal activities (Article 20(4)).
- Include in the notification the information that lets the Centro determine the importance of cross-border impacts (Article 20(2)).
- Notify an incident only where you have access to the information needed to assess its impact against those parameters (Article 20(5)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 23 classifies infractions of the decree-law as contraordenações (administrative offences), which Articles 24 and 25 punish with fines.
Penalty structure
Article 25 punishes a serious infraction, which includes failing to notify an incident under Articles 16, 18 and 20, with a fine of 80,000$00 to 250,000$00 for a legal person and 20,000$00 to 80,000$00 for an individual.
- Rule
- Fixed only
- As of
- Minimum
- 80,000
- Currency
- CVE
- Fixed cap
- 250,000
Who enforces it
Enforcement body
The Centro Nacional de Cibersegurança, the national cybersecurity authority, which holds the powers of inspection and of applying sanctions under the decree-law.
Settledness
- As of
- Open questions
- Has the Centro Nacional de Cibersegurança been installed, since Article 33 starts Articles 16 to 28 180 days after its installation?
What this law does
Article 20 requires a digital service provider to notify the Centro Nacional de Cibersegurança of incidents with a substantial impact on the provision of its digital services, in the shortest period possible for handling the data. Article 31 requires a digital service provider to tell the Centro immediately when it starts its activity, once the Centro has been installed.
When LexLint raises it
When your app profile says your app operates a social platform.