Chad

Article 61 requires the controller, or its subcontractor, to notify both ANSICE and the affected data subject, without delay, of any security breach affecting that person's personal data.

This duty sits alongside article 59's confidentiality obligation and article 60's list of required technical and organizational security measures against alteration, damage, or unauthorized third-party access, and a controller or subcontractor who fails to meet the article 59 through 61 obligations is separately subject to criminal penalty.

Article 1 sets the law's object as protecting private and professional life against the collection, processing, transmission, storage, and use of personal data, subject to public-order protection, and article 2 applies it to any such operation by a natural person, the State, local authorities, or a public or private legal person.

Article 7 makes processing lawful when the data subject consents, or, absent consent, when it is indispensable to a legal obligation, a public-interest or public-authority mission, a contract to which the data subject is party, or safeguarding the data subject's interest or fundamental rights and freedoms.

Articles 8 through 10 require that collection and processing be lawful, fair, and non-fraudulent, and that data be collected for determined, explicit, and legitimate purposes and not processed incompatibly with them, and be adequate and not excessive for those purposes. Articles 11 through 15 require that data be retained no longer than the purpose requires, kept accurate, and that the controller inform the data subject and keep the data confidential and secure.

Article 29 bars a controller from transferring personal data to a country outside the CEMAC and CEEAC blocs unless that State ensures a sufficient level of protection for privacy and fundamental rights and freedoms with respect to the processing the data will or may undergo. Article 30 requires the controller to inform ANSICE before any transfer to such a third country, regardless of that country's adequacy.

Article 31 lets a transfer to a non-adequate country proceed by derogation where the data subject has unambiguously consented, the transfer is necessary to a contract with the data subject or its pre-contractual steps, the transfer is necessary to a contract in the data subject's interest between the controller and a third party, the transfer is necessary or legally required to safeguard an important public interest or to establish, exercise, or defend a legal claim, the transfer safeguards the data subject's vital interest, or the transfer comes from a public register open to public consultation under legislative or regulatory provision.

Article 32 lets ANSICE authorize a transfer or set of transfers to a non-adequate country where the controller offers sufficient guarantees for privacy and fundamental rights and freedoms, including through appropriate contractual clauses.

Article 35 requires a controller collecting personal data directly from the data subject to provide, at collection, its own identity, the processing purposes, the categories of data, the recipients, the retention period, the existence of access and rectification rights, and any prospect of transfer to a third country; article 36 extends this duty to data not collected directly from the data subject, timed to registration or first communication to a third party.

Article 38 lets any natural person demand, free of charge, confirmation of whether their data is processed, communication of that data and its origin, information on the processing's purposes, legal basis, categories, and recipients, and information on any transfer to a third country; article 39 adds a copy of the data at no more than reproduction cost, and under article 43 the controller may refuse a manifestly abusive request, bearing the burden of proving abuse.

Article 45 gives any natural person the right to object, on legitimate grounds, to processing of their personal data, and specifically to object, free of charge, before their data is first communicated to a third party or used for prospecting on a third party's behalf, except where the processing meets a legal obligation.

Article 46 lets any natural person demand, free of charge, that the controller rectify, complete, update, block, or erase personal data concerning them that is inaccurate, incomplete, equivocal, outdated, or unlawfully collected, used, communicated, or retained, within one month of a written request, on pain of a complaint to ANSICE.

Article 48 has a minor's rights exercised by the parent holding parental authority or the minor's guardian, with the minor associated to the exercise of those rights according to age and maturity.

Article 80 lets ANSICE warn a controller who fails to meet the law's obligations, order the failure stopped within a set period, and impose a penalty in line with the failure found, its amount fixed by regulation.

Article 81 lets ANSICE, in urgent cases where a treatment or use of personal data violates rights and freedoms, order after adversarial procedure the interruption of a processing operation or the blocking of the data concerned for up to three months, or a temporary or definitive prohibition of a processing operation contrary to the law.

Article 82 punishes an ANSICE member, staff member, or expert who breaches the confidentiality obligation the ANSICE-establishment law binds them to, with three months to one year's imprisonment and a fine of one to ten million CFA francs, or one of those penalties alone; article 83 imposes the same range on a controller, representative, employee, or agent who fails to meet the confidentiality and security obligations of articles 59, 60, and 61.

Article 84 imposes the same range on a controller, representative, employee, or agent who processes data in violation of the collection and purpose-limitation conditions of articles 8 through 12, the sensitive-category conditions of articles 16 through 22 and 24, the information duty of article 35, or the notification formalities of article 65, who fails to respond to an access request under article 38 within one month or knowingly gives inaccurate or incomplete information, who gives incomplete or inaccurate information in an article 70 declaration, who transfers personal data outside the CEMAC or CEEAC blocs in violation of article 29 without satisfying an article 31 ground, or who obstructs ANSICE's verification powers; the same article punishes anyone who uses coercion, violence, threats, gifts, or promises to force a person to disclose information obtained through their article 38 rights or to consent to processing of their data.

Article 88 lets a convicting court bar the offender from managing personal-data processing, personally or through another, for up to two years, and article 89 punishes any breach of that bar, or any repeat offence under article 88, with six months to two years' imprisonment and a fine of one to five million CFA francs, or one of those penalties alone. Article 90 makes the controller or their representative in Chad civilly liable for fines their employee or agent is ordered to pay.

Article 93 gives anyone harmed by unlawful processing or any act inconsistent with the law the right to obtain reparation from the controller, and article 94 lets the controller be exonerated, in whole or part, by proving the harmful act is not attributable to them.

Article 16 prohibits processing biometric data and personal data revealing racial or ethnic origin, filiation, political opinion, religious or philosophical belief, trade-union membership, sex, health, or sexual life, unless the data subject gives explicit written consent (withdrawable at any time, at no cost), or the processing falls within a listed exception: a labour-law obligation, protecting the data subject's or another's vital interest, a human-rights association's activity authorized by ANSICE, a social-security purpose, establishing or defending a legal claim, data the data subject has manifestly made public, historical, statistical, or scientific research on conditions ANSICE sets, public-statistics law, preventive medicine or health-service administration under a health professional's supervision, or another important public-interest ground a law permits.

Article 17 confines the processing it covers to cases of the data subject's written consent or of necessity for preventing a concrete danger or repressing a specific criminal offence, and then only under a health professional's responsibility, binding that professional and their staff to professional secrecy.

Article 18 separately prohibits processing genetic data and personal data revealing health-related secrets, subject to a similarly structured list of exceptions, and article 20 requires that any such processing use a unique patient identifier distinct from other identification numbers, interconnectable with another identifying number only with ANSICE's express authorization.

Article 24 confines processing a minor's personal data to the representation rules the law sets for the exercise of a minor's own rights.

Article 429 punishes any person who accesses or attempts to access, fraudulently, all or part of a computer system, and the same person who fraudulently procures or attempts to procure, for themselves or another, any advantage by entering a computer system. Article 430 punishes fraudulently remaining or attempting to remain in all or part of a computer system, and hindering, falsifying, or attempting to hinder or falsify the operation of a computer system.

Article 431 punishes fraudulently introducing or attempting to introduce data into a computer system. Each offence carries imprisonment of one to five years and a fine of 1,000,000 to 10,000,000 CFA francs, or one of those two penalties only. Because each offence's trigger is fraudulent access, entry, or introduction, a scraper reading a public, unauthenticated page without defeating any access control falls outside a plain reading of these provisions.

This chapter codifies the offences originally created by Loi n°009/PR/2015 on cybersecurity and cybercrime. Article 521 of the Code provides that it is in force on the first day of the third month after its promulgation, and no source stating the resulting day has been located.

Article 9 excludes official legislative, administrative, or judicial texts and their official translations, the news of the day, and mere facts and data from copyright protection outright: a bare fact, or the news of the day as such, is never a protected work under Chadian law, whichever outlet reports it first.

Article 34(3) separately lets any person, once a work has been lawfully disclosed, and provided the author's name and source are clearly credited, make short critical, polemical, pedagogical, scientific, or informative analyses and quotations, compile press reviews, and reproduce or broadcast, even in full, current political, social, economic, or religious news articles and public speeches delivered before political, administrative, judicial, or academic assemblies, and sermons, lectures, and addresses, for current-events informational purposes.

The text does not cap the exception at a headline-length or short-extract threshold and does not confine it to the press industry. The Law names no day for its entry into force, and no Journal officiel issue or commencement notice for it has been located.