DjiboutiNational Cybersecurity Authority Law: Significant Incident Notification by Operators of Vital Importance
Loi n° 195/AN/25/9ème L portant création de l’Autorité Nationale de Cybersécurité, Art. 13
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting
As of .
What it requires
- Applies to a public or private operator that manages an infrastructure of vital importance, that is an installation, system or service whose unavailability would gravely compromise national security, the economy or public health.
- Notify without delay any security incident liable to affect the continuity of service of your infrastructure of vital importance for more than four consecutive hours, or compromising the integrity of sensitive data.
- Cooperate in the investigations that follow a major incident.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 14 provides administrative sanctions only: a formal notice, an administrative fine, and in exceptional cases a temporary ban on operating certain information systems.
Penalty structure
Administrative fine of up to 2 percent of total worldwide annual turnover of the previous financial year for a private company, or up to 1 percent of the annual budget for a public entity (Article 14). Article 14 adds a formal notice to comply and, exceptionally and where there is a grave and imminent risk to national security, a temporary ban on operating certain information systems for up to one month, renewable once.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Autorité Nationale de Cybersécurité (the National Cybersecurity Authority), which pronounces the administrative sanctions after adversarial proceedings; its decisions are open to appeal before the administrative court.
Settledness
- As of
- Open questions
- Which body receives the notice of a significant security incident, and in what form, given that Article 13 names no recipient, form or numeric deadline?
What this law does
Article 13 requires an operator of vital importance to notify without delay any significant security incident. The law defines a significant security incident as an incident liable to affect the continuity of service of an infrastructure of vital importance for more than four consecutive hours or compromising the integrity of sensitive data. The law defines a security incident as an event compromising or liable to compromise the security of an information system.
The law defines an infrastructure of vital importance as an installation, system or service whose unavailability would gravely compromise national security, the economy or public health. An operator of vital importance is a public or private person managing an infrastructure of vital importance. Article 13 also requires an operator of vital importance to cooperate in investigations in the event of a major incident.
The Authority performs the functions of the national Computer Emergency Response Team. Non-compliance with the law's obligations draws administrative sanctions the Authority pronounces after adversarial proceedings. An administrative fine under Article 14 may not exceed 2 percent of total worldwide annual turnover of the previous financial year for a private company or 1 percent of the annual budget for a public entity.
Decisions taken under Articles 11 and 13 may be challenged by a suspensive appeal to the administrative judge. The National Assembly adopted the law in its second public sitting of . The President of the Republic signed the law at Djibouti on . The Journal Officiel published the law on in edition n° 23 of . Article 31 provides that the law is registered and published in the Journal Officiel upon its promulgation.
Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means.
When LexLint raises it
When your app profile says your app runs an essential service.