ChadLoi n°007/PR/2015, obligation de notification des violations de données à l'ANSICE
Loi n°007/PR/2015 du 10 février 2015, art. 61
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://arcep.td/sites/default/files/Loi-N%C2%B007-PR-2015.pdfIn force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Security
- Audit expectation
- none
What it requires
- Notify both ANSICE and the affected data subject, without delay, of any security breach affecting that person's personal data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 61 makes the controller or its processor notify ANSICE and the affected person, without delay, of any security breach affecting that person's personal data. That is a duty to notify. The article does not tell the controller to document breaches or keep a register of them, and it names no review of a kept record. The security measure in article 60(c), which makes it possible to establish afterwards who had access to the information system and which data were read or entered, when and by whom, is in an article this row does not cite, so it is not borrowed. The article names no territorial hook, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 61 requires the controller, or its subcontractor, to notify both ANSICE and the affected data subject, without delay, of any security breach affecting that person's personal data.
This duty sits alongside article 59's confidentiality obligation and article 60's list of required technical and organizational security measures against alteration, damage, or unauthorized third-party access, and a controller or subcontractor who fails to meet the article 59 through 61 obligations is separately subject to criminal penalty.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .