Privacy Map

Democratic Republic of the Congo. Comprehensive data protection. Law

Code du numériqueOrdonnance-loi No. 23/010 of 13 March 2023 on the Digital Code (Code du numérique) – personal data provisions

In force
Partly verifiedMedium confidence. Legality of ARPTIC interim mandate contested by scholars. ARPTIC URL not verified. [Link: unofficial copy (droitnumerique.cd)]

§1Summary

Synopsis

The DRC Digital Code contains the country's first general personal data rules, using a consent-centric model with declaration and authorisation formalities. The dedicated authority has not been created.

Key themes
  • consent
  • declaration
  • authorisation
  • DPO
  • transfers
  • administrative fines
Unique features

Collection is prohibited in principle unless prior explicit consent (or prosecutor request); distinguishes 'transmission' from 'transfer' abroad.

SaaS relevance

Hosting data with providers whose servers are outside the DRC counts as a transfer needing equivalent protection.

§2Obligations

Breach notification
Authority without delay (via DPO); not yet operational
DPO
No
Cross-border transfers
Equivalent protection; authorisation regime
Maximum penalty
USD 70,000 administrative fine

§3Dates

Key dates
  • Adopted
  • In force
  • Published in Journal Officiel 2023-04-11; 2024-08-17 ministerial decree gave interim tasks to ARPTIC; APD decree pending

§4Text and authority

Text
Authority
Not yet established (Autorité de Protection des Données; ARPTIC acting on interim basis)

§5Where it applies

Domestic law of
Democratic Republic of the Congo

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Legality of ARPTIC interim mandate contested by scholars. ARPTIC URL not verified. [Link: unofficial copy (droitnumerique.cd)]