ParaguayTrust Services Law, Security Breach Notification by Trust Service Providers
Ley N° 6822/2021 De los servicios de confianza para las transacciones electrónicas del documento electrónico y los documentos transmisibles electrónicos, arts. 13, 20(2) y 21
In force.
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds a qualified or non-qualified trust service provider (prestador de servicios de confianza), a natural or legal person that provides one or more trust services such as electronic signatures, seals, time stamps or certificates, whether it is a private business or a public body (reached by declaring that you operate an essential service).
- Notify the supervisory body and the Centro de Respuestas a Incidentes Cibernéticos of the Ministerio de Tecnologías de la Información y Comunicación (CERT-PY) of any security breach that has a significant impact on the trust service you provide or on the related personal data, without undue delay and in any case within twenty-four hours of becoming aware of it (Article 20, paragraph 2).
- Notify the Autoridad de Aplicación of every such breach, treating as a security breach an event that critically affects the confidentiality, integrity or availability of information assets (Article 13, paragraph 1).
- Where the breach may harm a natural or legal person to whom you provided the service, notify that person too, without undue delay (Article 20, paragraph 2).
- After the incident is resolved, expand the information you gave in the initial notification, following any guidelines the Autoridad de Aplicación sets (Article 13, paragraph 3).
- Expect the supervisory body to inform the public of the breach, or to require you to do so, where it considers that disclosure is in the public interest (Article 20, paragraph 2).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Ministerio de Industria y Comercio, through its Dirección General de Firma Digital y Comercio Electrónico, as the Autoridad de Aplicación of the Law.
Settledness
- As of
- Open questions
- What form and content does the Autoridad de Aplicación require for the notification?
What this law does
Article 20, paragraph 2 requires a qualified or non-qualified trust service provider to notify the supervisory body and the Centro de Respuestas a Incidentes Cibernéticos of the Ministerio de Tecnologías de la Información y Comunicación of a security breach with a significant impact on the trust service, without undue delay and in any case within twenty-four hours of becoming aware of it.
Article 20, paragraph 2 requires the provider to notify a natural or legal person to whom it provided the service when the security breach may harm that person. Article 20, paragraph 2 provides that the notified supervisory body informs the public of the breach, or requires the provider to do so, when it considers that disclosure is in the public interest.
Article 13, paragraph 1 requires qualified and non-qualified trust service providers to notify the Autoridad de Aplicación of the security breaches they suffer. Article 13, paragraph 3 requires providers to expand the information in the initial notification once the incident is resolved, following the guidelines the Autoridad de Aplicación may set.
Article 21, paragraph 4, items f and g lists the failure to give the twenty-four hour notification, or to notify an affected person, among the serious infractions. Article 22 sets a fine of 1,001 to 5,000 minimum daily wages (jornales mínimos) for a serious infraction and 5,001 to 10,000 minimum daily wages for a very serious one.
When LexLint raises it
When your app profile says your app runs an essential service.