Digital Code, Book I: personal-data breach notification

Code Numérique, Livre Premier, Arts. 14 et 15 (notification des atteintes à la sécurité)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 18 September 2025.

A breach notification rule binding public and private bodies.

As of 19 September 2026.

What it requires

Notify the Commission Nationale de Protection des Données à Caractère Personnel of a personal-data breach without undue delay and, at the latest, within 72 hours of becoming aware of it, stating the reasons for any delay beyond that window.
Tell the affected individual of the breach without undue delay, in clear and simple terms, where it is likely to result in a high risk to their rights and freedoms.
As a processor, notify the controller of a personal-data breach without undue delay after becoming aware of it.
Describe in the notification the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned, the contact point, the likely consequences, and the measures taken or proposed to address it, and supply the information in stages where it cannot all be given at once.
Keep a register of every personal-data breach, its facts, its effects and the remedial measures taken, and make it available to the Commission on request.

What it reaches

Obligation class

Breach notice, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 14 requires the controller, in the event of a personal-data breach, to notify the Commission without undue delay and, at the latest, within 72 hours of becoming aware of it, and to accompany a notification made outside that window with the reasons for the delay.

Article 14 also requires the processor to notify the controller of a personal-data breach without undue delay after becoming aware of it, and requires the notification to the Commission to describe the nature of the breach, including where possible the categories and approximate number of data subjects and of records concerned, the contact point, the likely consequences, and the measures taken or proposed to address it, supplied in stages without further undue delay where it cannot all be given at once.

Article 14's closing paragraph requires the controller to keep a register of every personal-data breach, its facts, its effects and the remedial measures taken, for the Commission to check compliance on request.

Article 15 requires the controller to tell the affected individual of a breach without undue delay, in clear and simple terms, where the breach is likely to result in a high risk to their rights and freedoms, and excuses that communication only where protective measures such as encryption render the affected data unintelligible, where subsequent measures make the high risk no longer likely, or where it would involve a disproportionate effort and an equally effective public communication is made instead.

The Digital Code, including Book I, was adopted by the National Assembly on 30 June 2025 and signed by the President of the Republic on 6 July 2025. It was published in the Journal Officiel on 18 September 2025, the date these provisions took effect.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
operates_essential_service

Read the law

Text of Loi n° 019/AN/23/9ème L portant Code Numérique, Livre Premier, reproduced by the Journal Officiel de la République de Djibouti

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app