ChadLoi n°007/PR/2015, sanctions administratives et pénales et recours
Loi n°007/PR/2015 du 10 février 2015, arts. 80-94
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://arcep.td/sites/default/files/Loi-N%C2%B007-PR-2015.pdfIn force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Transfer, Governance
- Audit expectation
- none
What it requires
- Comply with an ANSICE warning or formal notice to cease a failure within the period ANSICE sets, on pain of a regulatory penalty and, for the underlying violation, criminal prosecution.
- Meet the collection, purpose-limitation, sensitive-category, information, access-response, notification, declaration, and cross-border transfer conditions the law sets, each of which carries its own criminal exposure on breach.
- Do not obstruct ANSICE, its members, or the experts it requires in exercising their verification powers.
- Compensate a person harmed by unlawful processing or any act inconsistent with the law, unless the harmful act is proven not attributable to the controller.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 82 punishes an ANSICE member, staff member, or expert's breach of confidentiality, and article 83 punishes a controller, representative, employee, or agent's failure to meet the confidentiality and security obligations of articles 59-61, each with three months to one year's imprisonment and a fine of 1,000,000 to 10,000,000 CFA francs, or one of those two penalties alone. Article 84 imposes the same three-months-to-one-year, 1,000,000-to-10,000,000-CFA-franc range on a controller, representative, employee, or agent who violates the collection and purpose-limitation conditions (arts. 8-12), the sensitive-category conditions (arts. 16-22 and 24), the information duty (art. 35), the notification formalities (art. 65), or the cross-border transfer conditions (arts. 29/31), who mishandles an access request (art. 38) or an article 70 declaration, or who obstructs ANSICE, and the same range reaches anyone who coerces a person over their article 38 rights. Article 89 separately punishes breaching a court's article 88 prohibition on managing personal-data processing, or a repeat offence under that article, with six months to two years' imprisonment and a fine of 1,000,000 to 5,000,000 CFA francs, or one of those two penalties alone.
Penalty structure
The dominant tier (arts. 82-84) is a fine of 1,000,000 to 10,000,000 CFA francs (XAF), with imprisonment of three months to one year as an alternative or cumulative penalty, covering confidentiality and security breaches (arts. 59-61), collection and sensitive-category violations (arts. 8-12, 16-22, 24), information and access-request failures (arts. 35, 38), declaration and cross-border transfer violations (arts. 65, 70, 29/31), and obstruction of ANSICE. A separate, lower-cap tier (art. 89) fines 1,000,000 to 5,000,000 CFA francs, with imprisonment of six months to two years, for breaching a court-ordered prohibition on managing processing (art. 88) or a repeat offence.
- Rule
- Fixed only
- As of
- Currency
- XAF
- Fixed cap
- 10,000,000
Who enforces it
Enforcement body
Agence Nationale de Sécurité Informatique et de Certification Electronique (ANSICE), the national authority that supervises the law
Settledness
- As of
- Open questions
- Has a regulation fixed the amount of the administrative penalties ANSICE may impose under article 80 of Loi n°007/PR/2015, which provides that "Le montant des pénalités est fixé par voie règlementaire" (the amount of the penalties is fixed by regulation)?
What it makes you log
Logging duty
Articles 80 and 81 let ANSICE issue warnings, formal notices and penalties and, in urgent cases and after adversarial proceedings, interrupt processing or block data for up to three months or ban a processing operation. Articles 82 to 90 set criminal penalties, including for breaching articles 59 to 61 and for obstructing ANSICE's verifications, and articles 91 to 94 give recourse to ANSICE and the courts and let a controller escape liability by proving that the damage is not attributable to it. Proving a cause in a liability claim is a litigation burden, and no clause requires anyone to make, keep or produce a log or record. ANSICE's powers of verification are defined in articles this row does not cite, so no audit expectation is coded. Article 83 makes a breach of articles 59, 60 and 61 a crime, and the access-trace measure in article 60(c) is in an article this row does not cite, so it is not borrowed. Article 84(i) punishes obstructing ANSICE's verifications without saying what they cover or naming a record. Article 90 makes the controller or its representative in Chad civilly liable for fines imposed on its agent, which is a rule on payment and not a statement of the law's reach. The articles name no territorial hook, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 80 lets ANSICE warn a controller who fails to meet the law's obligations, order the failure stopped within a set period, and impose a penalty in line with the failure found, its amount fixed by regulation.
Article 81 lets ANSICE, in urgent cases where a treatment or use of personal data violates rights and freedoms, order after adversarial procedure the interruption of a processing operation or the blocking of the data concerned for up to three months, or a temporary or definitive prohibition of a processing operation contrary to the law.
Article 82 punishes an ANSICE member, staff member, or expert who breaches the confidentiality obligation the ANSICE-establishment law binds them to, with three months to one year's imprisonment and a fine of one to ten million CFA francs, or one of those penalties alone; article 83 imposes the same range on a controller, representative, employee, or agent who fails to meet the confidentiality and security obligations of articles 59, 60, and 61.
Article 84 imposes the same range on a controller, representative, employee, or agent who processes data in violation of the collection and purpose-limitation conditions of articles 8 through 12, the sensitive-category conditions of articles 16 through 22 and 24, the information duty of article 35, or the notification formalities of article 65, who fails to respond to an access request under article 38 within one month or knowingly gives inaccurate or incomplete information, who gives incomplete or inaccurate information in an article 70 declaration, who transfers personal data outside the CEMAC or CEEAC blocs in violation of article 29 without satisfying an article 31 ground, or who obstructs ANSICE's verification powers; the same article punishes anyone who uses coercion, violence, threats, gifts, or promises to force a person to disclose information obtained through their article 38 rights or to consent to processing of their data.
Article 88 lets a convicting court bar the offender from managing personal-data processing, personally or through another, for up to two years, and article 89 punishes any breach of that bar, or any repeat offence under article 88, with six months to two years' imprisonment and a fine of one to five million CFA francs, or one of those penalties alone. Article 90 makes the controller or their representative in Chad civilly liable for fines their employee or agent is ordered to pay.
Article 93 gives anyone harmed by unlawful processing or any act inconsistent with the law the right to obtain reparation from the controller, and article 94 lets the controller be exonerated, in whole or part, by proving the harmful act is not attributable to them.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .