NigerLoi n° 2022-59, notification des violations de données
Loi n° 2022-59, arts. 83 et 86 (notification des violations de données à caractère personnel)
In force.
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the HAPDP of a personal data breach without delay after becoming aware of it, and justify to the HAPDP any notification made outside that timeframe.
- Notify the affected person of a personal data breach as soon as possible when it is likely to create a high risk to their rights and freedoms; you need not notify the person where it is reasonable to believe the breach creates no such risk.
- As a data processor, notify the controller of a personal data breach as soon as possible and no later than 72 hours after becoming aware of it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 83 requires the controller to notify a breach to the HAPDP without delay, to justify and give reasons to the HAPDP for any failure to do so, and to tell the data subject where the risk is high; article 86 requires a processor to notify the controller within 72 hours. These are duties to notify. Neither says to document breaches, notified or not, so no breach register is required by the cited text.
- Kind
- None
- As of
What this law does
Article 83 requires the controller to notify the HAPDP of a personal data breach without delay after becoming aware of it, and to justify to the HAPDP any notification made outside that timeframe. The controller must also notify the affected person as soon as possible when the breach is likely to create a high risk to their rights and freedoms, and is excused from notifying the person only where it is reasonable to believe the breach creates no such risk.
Article 86 requires a data processor to notify the controller of a personal data breach as soon as possible and, at the latest, within 72 hours of becoming aware of it. Article 113, the closing article, orders publication in the Journal Officiel and execution as a law of the State, but names no day of the Law's own entry into force, and no commencement notice has been located in the Journal Officiel.
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .