RwandaLaw governing Information and Communication Technologies, Notice of Network Security Risks to Users
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Disclosure
As of .
What it requires
- This binds an electronic communications network or service provider (article 125) and a provider of public electronic communications services acting with a provider of electronic networks services (article 208) (reached by declaring that you provide telecommunications services). Law N° 24/2016 came into force on its publication in the Official Gazette of .
- Inform users about any security risks that may occur as a result of a breach of network security measures or protocols, and the remedies available to address the breach (article 125).
- Where there is a significant risk to the security of the services you provide, inform the subscribers of the risk, any appropriate measures they may take to safeguard against it and the likely costs to them of taking such measures, free of any charge other than the cost they would have incurred for accessing the information (article 208).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Regulatory Authority, which has the power to monitor the activities of licensed operators and to impose administrative sanctions on them.
Settledness
- As of
- Open questions
- By what time after a breach of network security must a provider inform users under article 125, given that the article states no period?
- Has Law N° 24/2016 been amended or replaced since its publication on , as far as articles 125 and 208 are concerned?
What this law does
Article 125 of Law N° 24/2016 requires a licensed electronic communications service provider to inform users about any security risks which may occur as a result of a breach of network security measures or protocols and the necessary remedies available to address the breach.
Article 208 requires a service provider, where there is a significant risk to the security of provided services, to inform the subscribers of the risk, any appropriate measures that the subscriber may take to safeguard against that risk and the likely costs to the subscriber of taking such measures. Article 208 also requires the information to be provided to the subscriber free of any charge other than the cost that the subscriber would have incurred for accessing the information.
Article 15 gives the Regulatory Authority the power to monitor the activities of licensed operators and impose administrative sanctions on them. The Law comes into force on the date of its publication in the Official Gazette of the Republic of Rwanda (article 310). The Law was published in Official Gazette 26 of .
When LexLint raises it
When your app profile says your app provides telecom services.