DjiboutiDigital Code, Book I: the Commission, administrative sanctions and criminal offences
Code Numérique, Livre Premier, Arts. 104, 135 et 140 à 156 (Commission et sanctions)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Commission Nationale de Protection des Données à Caractère Personnel (CNDP)
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Comply with a formal notice the Commission addresses to you, or expect an injunction, a withdrawal of authorization, the locking of the data concerned, or an administrative sanction of up to 70,000,000 Djiboutian francs or 5% of your worldwide turnover, whichever is higher, plus a daily penalty payment for continued non-compliance.
- Expect a criminal prosecution carrying imprisonment and a fine under Chapter 6 for processing without the required prior formalities, for an unauthorized transfer, for an unlawful disclosure, or for another offence that chapter creates, on top of the Commission's own administrative sanction for the same facts.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Chapter 6 of Book I (Articles 141 to 154) criminalises non-compliance with prior formalities, unauthorized processing of the national identification number, processing sensitive or offence-related data outside the statutory grounds, fraudulent collection, misuse of purpose, unauthorized transfer, disregarding an objection, failing to secure or notify a breach, retaining data beyond its legal duration, and unauthorized disclosure. Most of these draw 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 Djiboutian francs; unauthorized processing of the national identification number draws 5 years and a fixed 4,000,000 francs; and a negligent (rather than intentional) unauthorized disclosure draws 5 years and a fixed 7,000,000 francs.
Penalty structure
Article 135's Commission-imposed administrative sanction: up to 70,000,000 Djiboutian francs or, for an enterprise, 5% of its worldwide annual turnover excluding tax for the last closed financial year, whichever is higher, plus a daily penalty payment of up to 35,000,000 francs for continued non-compliance with a formal notice. This is distinct from Chapter 6's criminal fines (7,000,000 to 35,000,000 francs typically, as low as 4,000,000 francs for the national-identification-number offence), which accompany imprisonment and are set out in the criminal exposure note.
- Rule
- Higher of
- As of
- Currency
- DJF
- Fixed cap
- 70,000,000
- Turnover percentage cap
- 5
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 104 creates the Commission, Article 135 lists the sanctions it may impose after a formal notice, and Articles 140 to 156 set the offences. Article 143 makes it an offence to refuse the Commission's members or agents the information and documents useful to their mission, to hide or destroy them, or to give information that does not match the content of the records as they stood when the request was made. That is the Commission's power to demand documents, exercised when it chooses, and no article in the row requires a log or register to be made or kept. Article 152 punishes failing to notify a breach, but the register is required by Article 14, which this row does not cite. The scope clause is not cited, so the row names no territorial hook.
- Kind
- None
- As of
What this law does
Article 104 establishes the Commission Nationale de Protection des Données à Caractère Personnel as an independent administrative authority charged with overseeing compliance with Book I. Article 135 lets the Commission, where a controller does not comply with a formal notice, impose an injunction to bring processing into conformity or to satisfy a data subject's rights request, an injunction to stop processing or a withdrawal of authorisation, the locking of certain data, and an administrative sanction proportioned to the seriousness of the breach and the advantages drawn from it, capped at 70,000,000 Djiboutian francs or, for an enterprise, 5% of its worldwide turnover excluding tax for the last closed financial year, whichever is higher, on top of a daily penalty payment of up to 35,000,000 francs for continued non-compliance.
Chapter 6 (Articles 140 to 156) applies the Penal Code's general rules on attempt, complicity, receiving, and corporate liability to the offences it creates.
Article 141 punishes processing personal data without the prior formalities Chapter 2 of Title 3 requires, and Article 144 punishes processing that includes the national identification number outside an authorised case, each by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 Djiboutian francs, except Article 144's offence, which draws 5 years and a fixed fine of 4,000,000 francs.
Article 145 punishes unlawfully keeping sensitive personal data or offence-related data in computerised memory without the data subject's express consent, Article 146 punishes an unlawful health-research processing, Article 148 punishes misuse of purpose, and Article 149 punishes an unauthorised cross-border transfer, each by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 Djiboutian francs (Article 149's fine is a fixed 8,000,000 francs), while Article 147 punishes fraudulent collection by a maximum of 10 years' imprisonment, with no stated minimum, and a fine of 7,000,000 to 35,000,000 francs.
Article 150 punishes disregarding a data subject's objection by 6 months to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 francs, Article 151 punishes processing without the security measures Articles 11 to 13 require by 10 years' imprisonment and a fixed fine of 8,000,000 francs, Article 152 punishes failing to notify a personal-data breach by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 francs, and Article 153 punishes retaining personal data beyond its legal retention period by the same range.
Article 154 punishes an unauthorised disclosure of personal data by 5 to 10 years' imprisonment and a fine of 7,000,000 to 35,000,000 francs, falling to a fixed 5 years and 7,000,000 francs where the disclosure was merely negligent, and that prosecution runs only on the victim's own complaint.
Article 155 lets the criminal court order the erasure of the personal data at issue in an offence under this chapter, and Article 156 requires the public prosecutor to keep the Commission's president informed of the prosecutions this chapter's offences give rise to. The Digital Code, including Book I, was adopted by the National Assembly on and signed by the President of the Republic on . The Digital Code states no day of entry into force.
Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means. The Digital Code appears in edition n° 04 of the Journal Officiel dated .
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .