Republic of the Congo. Comprehensive data protection. Law
Law 29-2019Law No. 29-2019 of 10 October 2019 on the protection of personal data
In force
Partly verified
Medium confidence.[Link: Journal officiel no. 45 of 7 Nov 2019 (SGG Congo)]
§1Summary
- Synopsis
Congo-Brazzaville's data protection law with notification, authorisation, DPO and 72-hour breach notification. The supervisory commission still needs its own founding law.
- Key themes
- Unique features
All breaches must be reported, even those without risk, within 72h.
- SaaS relevance
SaaS providers should support 72h breach reporting and prior transfer notice once the commission is constituted.
§2Obligations
- Breach notification
- Commission within 72h (all breaches); individuals if significant risk
- DPO
- Conditional
- Cross-border transfers
- Similar protection plus prior notice
- Maximum penalty
- USD 180,000 approx. plus criminal sanctions
§3Dates
- Key dates
- Adopted
- In force
- Published 2019-11-07; bill creating the National Commission approved by Council of Ministers July 2024, not yet adopted
§4Text and authority
- Text
- Authoritative text sgg.cg
- Authority
- Not yet established (Commission Nationale de Protection des Données à caractère Personnel provided for)
§5Where it applies
- Domestic law of
- Republic of the Congo
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.[Link: Journal officiel no. 45 of 7 Nov 2019 (SGG Congo)]