SenegalElectronic Communications Code, Notification of Security Breaches
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds an operator, meaning any legal person that operates an electronic communications network open to the public or provides an electronic communications service to the public (reached by declaring that you provide telecom services).
- As soon as you become aware of it, inform the Minister of the Interior of any breach of security or loss of integrity having a significant impact on the operation of your networks or services (article 16).
- Where the breach or loss results or may result from a computer attack, also inform the authority competent for the defence of information systems (article 16).
- Once you have analysed the causes and consequences, report to the government authority, and to the defence authority where it was informed, on the measures taken to avoid a recurrence (article 16).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
L'Autorité de Régulation des Télécommunications et des Postes (ARTP), which under article 211 has a power of sanction that includes pecuniary sanctions against defaulting operators.
Settledness
- As of
- Open questions
- Within what time must an operator inform the Minister of the Interior, given that article 16 says only as soon as the operator becomes aware of the breach?
What this law does
Article 16 of the Code requires an operator, as soon as it becomes aware of it, to inform the Minister of the Interior of any breach of security or loss of integrity having a significant impact on the operation of its networks or services. Where the breach of security or loss of integrity results or may result from a computer attack, the operator must also inform the authority competent for the defence of information systems.
Once the operator has analysed the causes and consequences of the breach or loss, it must report to the government authority, and to the defence authority where that authority was informed, on the measures taken to avoid a recurrence. Where it is in the public interest to disclose the facts, the Minister of the Interior may inform the public or ask the operator concerned to do so.
The Autorité de Régulation des Télécommunications et des Postes may sanction the failings it finds in respect of the Code's provisions. A penalty may not exceed three percent of the turnover achieved in Senegal in the preceding financial year, and may be doubled on a repeat breach in the same year.
When LexLint raises it
When your app profile says your app provides telecom services.