DjiboutiDigital Code, Book VII: National Health Data System Security Incident Reporting
Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Septième, Art. 747
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Criminal exposure note
- Article 747 states no penalty for a failure to report.
- Obligation class
- Reporting
What it requires
- Report a serious information-system security incident to the cybersecurity authority without delay, if you access data in Djibouti's national health data system as a health professional, health establishment, health-insurance financing body, or other body accessing that system.
- Expect a significant security incident to be separately and immediately transmitted by the national authority in charge of information systems to the State's competent authorities.
- No numeric reporting clock is stated for this duty; a decree defining which incidents count as significant, and how they are handled, was not located in this review.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
Autorité de la cybersécurité (the cybersecurity authority, which receives the report); the autorité nationale en charge des systèmes d'information (which transmits a significant incident to the State's competent authorities).
What this law does
Article 747 requires any person accessing data in Djibouti's national health data system, a category that reaches citizens, health-system users, health professionals, health establishments and their representative organisations, health-insurance financing bodies, State services and public health institutions under the surrounding Chapter, to report a serious information-system security incident to the cybersecurity authority without delay.
An incident the national authority in charge of information systems judges significant is separately and immediately transmitted to the State's competent authorities. A decree, proposed by the minister in charge of the digital economy after the cybersecurity authority's opinion, is to define which categories of security incident count as significant and how they are handled; that decree was not located in this review.
The article states no numeric reporting clock, only that notice is given without delay. The Digital Code was adopted by the National Assembly on and signed by the President of the Republic on . The Digital Code states no day of entry into force.
Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means. No notice or register stating the day the Digital Code came into force has been located.
When LexLint raises it
When your app profile says your app handles health records.
Back to the example · Lint your app
Page updated .