Compliance FrameworksAsia-Pacific
New Caledonia Loi Informatique et Libertes
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | NC LIL |
| Region | Asia-Pacific |
| Country or scope | New Caledonia |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers NC LIL
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
NC-LIL-34 Security of Processing | Controllers must take all useful precautions to preserve the security of personal data and prevent its alteration or access by unauthorised parties; integrity hashes on components let tampering be detected (Law 78-17, security-of-processing obligation, Art. 34 in the pre-2018 numbering). | Scan |
NC-LIL-REC Records of Processing Systems | The GDPR-equivalent accountability regime extended by the Act requires maintained records of processing, which presuppose an inventory of the software components performing it (Law 78-17, records-of-processing obligations as extended to New Caledonia). | Scan |
NC-LIL-ST Processor Guarantees | Processing may only be entrusted to processors presenting sufficient guarantees, so third-party components must have named, accountable suppliers (Law 78-17, processor obligations). | Scan |
NC-LIL-VER Breach-Notification Readiness | Notifying the CNIL of a breach within the required timeframe presupposes knowing the exact versions of the software processing personal data so impact can be assessed quickly (Law 78-17, breach-notification obligations). | Scan |
NC-LIL-DOC Demonstrable Compliance Documentation | Demonstrating compliance to the CNIL requires dated, identifiable documentation of the systems used to process personal data (Law 78-17, accountability obligations). | Scan |
NC-LIL-FMT Machine-Readable Processing Records | Records supporting supervisory review are most useful in standard machine-readable form, so the software inventory should be an SPDX or CycloneDX SBOM (Law 78-17, records and supervisory-cooperation obligations). | Scan |
Policy templates
All 22 from the standard set, adapted to NC LIL.