DjiboutiDigital Code, Book I: Personal Data Protection and CNDP
Loi n° 019/AN/23/9ème L portant Code Numérique Livre Premier, Arts. 2 à 13, 54, 57 et 66 à 73 (objet, champ d'application, obligations du responsable de traitement et formalités préalables)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Consent, Governance, Security, Licensing
- Audit expectation
- none
What it requires
- Obtain a lawful basis, most often the data subject's express, unambiguous, free, specific and informed consent, before processing their personal data.NIST Privacy FrameworkCT.PO-P1
- Build data protection into the design and the default settings of your processing, restrict processing to persons acting under your authority and on your instructions, and take the measures necessary to secure personal data against loss, alteration, or unauthorized access, having regard to its nature and the risks the processing presents.NIST Privacy FrameworkGV.PO-P2NIST Privacy FrameworkPR.DS-P5
- File a prior declaration with, or obtain the prior authorization of, the Commission Nationale de Protection des Données à Caractère Personnel before processing personal data, depending on the processing's risk category.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 13 requires the controller and the processor to take the technical and organizational measures needed so that, afterwards, it can be verified and established who had access to an automated processing system, which data were read or entered, at what time and by which person, and likewise who the third parties receiving data are. It sets no period for keeping that trail and names no body entitled to ask for it. Article 8 (point 8) has the processor give the controller the information needed to show compliance and allow audits by the controller or an auditor it appoints, which is a contract term between the two and not a check of the record by an authority. Article 57, which this row cites, only describes the form of a valid consent; the controller's duty to be able to show consent is in Article 58, which the row does not cite, so no consent record is stated for this row.
- Kind
- Explicit
- As of
- Provision
- Article 13 (security measures, third listed measure)
- Trigger
- personal_data_processing
What this law does
Article 2 states that Book I regulates the collection, transmission, storage, use and any other form of processing of personal data. Article 3 applies the book to automated and manual processing of personal data carried out by the State, a local authority, a public or private legal person, or a natural person, and Article 4 extends it to a controller or processor not established in Djibouti that offers goods or services to, or monitors the behaviour of, persons in Djibouti.
Article 5 exempts only purely domestic or personal processing not intended for onward communication, and temporary technical copies made for network transmission.
Article 6 places responsibility for a processing operation on the controller carrying it out under its own authority, Article 7 governs joint controllers, Article 8 governs recourse to a processor, Article 9 governs a sub-processing chain, and Article 10 requires a controller or processor not established in Djibouti to designate a representative there.
Article 11 requires data protection by design and by default, Article 12 requires processing to be carried out confidentially by persons acting under the controller's authority and on its instructions alone, and Article 13 requires the controller and processor to take the measures necessary to secure personal data, having regard to its nature and the risks the processing presents.
Article 54 sets the lawfulness, fairness, transparency, purpose-limitation and minimisation principles, and Article 57 requires an express, unambiguous, free, specific and informed consent wherever consent is the ground relied on.
Article 66 subjects processing to a prior declaration to the Commission unless another provision of this chapter says otherwise, Article 67 lets the Commission set a simplified declaration for the most common categories of processing, Article 68 exempts processing from declaration where the controller has designated a data protection officer, Article 69 subjects the processing it lists to the Commission's prior authorisation, and Article 73 exempts the processing it lists from every one of these prior formalities.
The Digital Code, including Book I, was adopted by the National Assembly on and signed by the President of the Republic on . The Digital Code states no day of entry into force.
Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means. The Digital Code appears in edition n° 04 of the Journal Officiel dated .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .