LexLint.ioBeta

Know the law your code answers to.

Law / Djibouti

Digital Code, Book I: personal-data breach notification

Code Numérique, Livre Premier, Arts. 14 et 15 (notification des atteintes à la sécurité)

In force since .

A breach notification rule binding public and private bodies.

Obligation class
Breach notice, Reporting
Audit expectation
on_request
Who audits it
Regulator
Where the report goes
Produced on request

What it requires

  • Notify the Commission Nationale de Protection des Données à Caractère Personnel of a personal-data breach without undue delay and, at the latest, within 72 hours of becoming aware of it, stating the reasons for any delay beyond that window.NIST Privacy FrameworkCM.AW-P7
  • Tell the affected individual of the breach without undue delay, in clear and simple terms, where it is likely to result in a high risk to their rights and freedoms.NIST Privacy FrameworkCM.AW-P7
  • As a processor, notify the controller of a personal-data breach without undue delay after becoming aware of it.NIST Privacy FrameworkCM.AW-P7
  • Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned, the contact point, the likely consequences, and the measures taken or proposed to address it, and supply the information in stages where it cannot all be given at once.NIST Privacy FrameworkCM.AW-P7
  • Keep a register of every personal-data breach, its facts, its effects and the remedial measures taken, and make it available to the Commission on request.NIST Privacy FrameworkPR.PO-P7

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
  • RS.CO-02Internal and external stakeholders are notified of incidents
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Regulator

Logging duty

The controller must record every personal-data breach in a register, whether or not it was notified, stating the facts of the breach, its effects and the remedial measures taken, and must hand that documentation to the Commission on request so the Commission can check compliance with Article 14. The register's contents are facts, effects and measures, none of which is a value in the log-contents list, so that list is empty. The Articles give no retention period, and neither article has a scope clause, so the row names no territorial hook.

Kind
Explicit
As of
Provision
Article 14, last paragraph (register of personal-data breaches)
Trigger
security_incident

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 14 requires the controller, in the event of a personal-data breach, to notify the Commission without undue delay and, at the latest, within 72 hours of becoming aware of it, and to accompany a notification made outside that window with the reasons for the delay.

Article 14 also requires the processor to notify the controller of a personal-data breach without undue delay after becoming aware of it, and requires the notification to the Commission to describe the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned, the contact point, the likely consequences, and the measures taken or proposed to address it, supplied in stages without further undue delay where it cannot all be given at once.

Article 14's closing paragraph requires the controller to keep a register of every personal-data breach, its facts, its effects and the remedial measures taken, for the Commission to check compliance on request.

Article 15 requires the controller to tell the affected individual of a breach without undue delay, in clear and simple terms, where the breach is likely to result in a high risk to their rights and freedoms, and excuses that communication only where protective measures such as encryption render the affected data unintelligible, where subsequent measures make the high risk no longer likely, or where it would involve a disproportionate effort and an equally effective public communication is made instead.

The Digital Code, including Book I, was adopted by the National Assembly on and signed by the President of the Republic on . The Digital Code states no day of entry into force.

Under Article 1 of the Civil Code (Loi n° 003/AN/18/8ème L), a law comes into force on the day it fixes or, failing that, on the day after its publication in the Journal Officiel, publication meaning the earliest publication, whether by the National Printing Office (Imprimerie Nationale) or by electronic means. The Digital Code appears in edition n° 04 of the Journal Officiel dated .

When LexLint raises it

When your app profile says your app runs an essential service or processes personal data.

Back to the example  ·  Lint your app

Page updated .