DjiboutiDigital Code, Book VII: Health-Data Hosting Security Certification
Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Septième, Arts. 760 à 763
In force.
A sector security regimes rule binding public and private bodies.
- Obligation class
- Licensing, Security
What it requires
- Hold a conformity certificate the national cybersecurity authority issues before hosting digital health data, if your activity is making available and maintaining the physical site, the physical or virtual infrastructure, or an application-hosting platform for a health-data information system, administering or operating such a system, or backing up health data.
- Expect the certificate's own issuance conditions to be set by a decree not located in this review.
- Expect the certificate to be withdrawn for a breach of the legislative or regulatory provisions governing digital health-data hosting, or of the certificate's own conditions.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
No monetary or criminal penalty for hosting digital health data without the Article 760 certificate was located in this review; Article 763's own sanction is withdrawal of the certificate.
Who enforces it
Enforcement body
Autorité nationale en charge de la cybersécurité (issues and may withdraw the digital health-data hosting conformity certificate).
Settledness
- As of
- Open questions
- Does the Article 760 certification duty reach a health-data host located outside Djibouti that hosts data for Djibouti's national health data system, a question the Articles cited here do not address?
What this law does
Article 760 requires a host of digital health data to hold a conformity certificate the national cybersecurity authority issues before providing that hosting.
Article 761 names the activities that count as certifiable hosting: making available and operationally maintaining the physical site or the physical or virtual infrastructure hosting a health-data information system, making available and maintaining an application-hosting platform for it, administering and operating an information system containing health data, and backing up health data, a list a decree may extend.
Article 762 leaves the certificate's own issuance conditions to a decree proposed by the ministry in charge of the digital economy. Article 763 lets the cybersecurity authority withdraw the certificate for a breach of the legislative or regulatory provisions governing digital health-data hosting, or of the certificate's own conditions, under conditions a decree sets; that decree has not been located, and no separate monetary penalty for hosting without certification has been located either.
The Digital Code was adopted by the National Assembly on and signed by the President of the Republic on . The Digital Code states no day of entry into force. Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means. No notice or register stating the day the Digital Code came into force has been located.
When LexLint raises it
When your app profile says your app handles health records.
Back to the example · Lint your app
Page updated .