ParaguayTrust Services Law, Security Requirements for Trust Service Providers
In force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a qualified or non-qualified trust service provider (prestador de servicios de confianza), a natural or legal person that provides one or more trust services such as electronic signatures, seals, time stamps or certificates, whether it is a private business or a public body (reached by declaring that you operate an essential service).
- Adopt the technical and organizational measures that are appropriate to manage the security risks of the trust services you provide, at a level of security proportionate to the degree of risk (Article 20, paragraph 1).
- Take measures to prevent and minimize the impact of security incidents and to inform the persons concerned of their negative effects (Article 20, paragraph 1).
- Manage the security incidents that affect you, with mechanisms for their prevention, detection, analysis and resolution (Article 13, paragraph 2).
- Resolve security incidents in your networks and information systems, because failing to do so is a serious infraction (Article 21, paragraph 4, item k).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Ministerio de Industria y Comercio, through its Dirección General de Firma Digital y Comercio Electrónico, as the Autoridad de Aplicación of the Law.
Settledness
- As of
- Open questions
- Which technical and organizational measures does the Autoridad de Aplicación treat as appropriate under Article 20, paragraph 1?
What this law does
Article 20, paragraph 1 requires qualified and non-qualified trust service providers to adopt the technical and organizational measures appropriate to manage the security risks of the trust services they provide. Article 13, paragraph 2 requires providers to manage the security incidents that affect them, with mechanisms for prevention, detection, analysis and resolution.
Article 21, paragraph 4, item k lists the failure to resolve security incidents in networks and information systems among the serious infractions. Article 22 sets a fine of 1,001 to 5,000 minimum daily wages (jornales mínimos) for a serious infraction and 5,001 to 10,000 minimum daily wages for a very serious one.
When LexLint raises it
When your app profile says your app runs an essential service.