DjiboutiDigital Code, Book VI: Critical Installation Protection and Operator Security Controls
Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Sixième, Titre 3 (Arts. 679 à 684)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 18 September 2025.
A sector security regimes rule binding private bodies.
As of 19 September 2026.
What it requires
- Implement a qualified system for detecting events capable of affecting your information systems' security, if you operate a public electronic communications network or provide a public electronic communications service in Djibouti. The detection system, and any service provider you use to run it, must be qualified by the national cybersecurity authority.
- Submit your information systems, at your own cost, to a control the cybersecurity authority conducts to verify their security level and your compliance with security rules.
- Maintain and keep in good condition any protective device you have established: failing to do so draws a fine of up to 10,000,000 Djiboutian francs.
- Expect the State to hold offence-capable equipment and data for cyberattack analysis and response through its own designated services, and to obtain your users' identity and contact details from you where those users hold a vulnerable, threatened or attacked information system, so the competent authority can alert them; obstructing either of these state functions draws a fine of up to 25,000,000 Djiboutian francs.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Failing to maintain and keep in good condition a protective device previously established under Articles 679 and 680 draws a fine of up to 10,000,000 Djiboutian francs (Article 681). Obstructing the State's Article 682 cyberattack-response function or the Article 683 user-alert data request draws a separate fine of up to 25,000,000 Djiboutian francs (Article 684). Both sanctions sit within Book VI's own criminal-procedure framework rather than the telecoms regulator's administrative sanctions power.
Penalty structure
Graduated by offence: failing to maintain and keep in good condition a protective device previously established under Articles 679 and 680 (Article 681) caps at 10,000,000 francs; obstructing the State's cyberattack-response function under Article 682 or the user-alert data request under Article 683 (Article 684) caps at 25,000,000 francs.
- Rule
- Fixed only
- As of
- 19 September 2026
- Currency
- DJF
- Fixed cap
- 25,000,000
Who enforces it
Enforcement body
Autorité nationale en charge de la cybersécurité (qualifies detection systems and service providers, and conducts the Article 680 security-level controls); a State service and a competent authority the Council of Ministers designates by decree (Articles 682 and 683).
Settledness
- As of
- 19 September 2026
- Open questions
- Does Titre 3's use of 'opérateurs' reach only the Article 1 definition of an electronic communications network or service operator, or does it extend to a broader class of critical-installation operator the Code does not separately define?
What it reaches
Obligation class
Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Book VI's Titre 3, headed the implementation of non-military and non-economic defence, requires an operator (the Code's own definition: any natural or legal person operating a public electronic communications network or providing a public electronic communications service to the public) to implement a qualified system for detecting events capable of affecting its information systems' security, qualified by the national cybersecurity authority together with the service providers that run such systems (Article 679).
The operator must submit its information systems to controls the cybersecurity authority conducts to verify their security level and compliance with security rules, at the operator's own cost (Article 680); omitting to maintain and keep in good condition a protective device previously established under this Chapter draws a fine of up to 10,000,000 Djiboutian francs (Article 681).
A separate Chapter lets a State service the Council of Ministers designates by decree hold equipment, instruments, programs and data capable of carrying out an offence, in order to analyse and respond to a cyberattack, a power on the State rather than a duty on the operator (Article 682), and lets a competent authority the Council of Ministers designates by decree obtain from an electronic communications operator the identity, postal address and electronic address of a user or holder of a vulnerable, threatened or attacked information system, in order to alert them to the vulnerability or compromise (Article 683).
Obstructing the accomplishment of the missions in Articles 682 and 683 draws a fine of up to 25,000,000 Djiboutian francs (Article 684).
When LexLint raises it
provides_telecom_services
Read the law
Text of Loi n° 019/AN/23/9ème L portant Code Numérique
Livre Sixième, Titre 3, reproduced by the Journal Officiel de la République de Djibouti
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.