Law / 
Democratic Republic of the Congo
Digital Code, Livre II: Trust Service Provider Security Risk-Management Duty
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 13 March 2023.
A sector security regimes rule binding public and private bodies.
As of 19 September 2026.
What it requires
- This binds a qualified or non-qualified trust service provider (prestataire de services de confiance), an electronic certification service provider, regardless of whether it is public or private.
- Take the technical and organizational measures necessary to prevent and manage the risks to the security of the trust services you provide, keeping the level of security proportional to the degree of risk given technological developments.
- Prevent and limit the consequences of security incidents, inform the parties concerned of the harmful effects of such incidents, and ensure the continuity of your services in the event of technical failures or cessation of activity.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 164 frames the sanction for a trust service provider's noncompliance with the ordonnance-loi, including the Article 147 duty, as an administrative one (a fine, a service suspension, or a prohibition on operating), not a criminal offense; the section carrying Article 164 is captioned Des sanctions administratives.
Penalty structure
Article 164 tiers the administrative sanction on a trust service provider by the impact of the breach: a suspension of service for ninety to three hundred sixty five days and/or a fine of 500,000 to 5,000,000 Congolese francs where the impact is limited to the certificate holder, a fine of 10,000,000 to 50,000,000 Congolese francs where the impact touches the integrity of holders' personal data, and a prohibition on operating in the Democratic Republic of the Congo where the breach touches national defense or state security. Article 164 applies to a trust service provider's noncompliance with the ordonnance-loi generally, including the Article 147 risk-management duty, and is not confined to Article 147.
- Rule
- Fixed only
- As of
- 19 September 2026
- Minimum
- 500,000
- Currency
- CDF
- Fixed cap
- 50,000,000
Who enforces it
Enforcement body
L'Autorité Nationale de Certification Électronique.
Settledness
- As of
- 19 September 2026
- Open questions
- Does the Autorité Nationale de Certification Électronique's own implementing guidance specify further technical security-measure standards under Article 147 beyond the statutory text itself?
What it reaches
Obligation class
Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 147 requires a qualified or non-qualified trust service provider to take the technical and organizational measures necessary to prevent and manage the risks to the security of the trust services it provides. Article 147 requires those measures to keep the level of security proportional to the degree of risk, given technological developments.
Article 147 requires the measures to prevent and limit the consequences of security incidents, inform the parties concerned of the harmful effects of such incidents, and ensure the continuity of services in the event of technical failures or cessation of activity.
A trust service provider that does not comply with the ordonnance-loi or with the requirements the Autorité Nationale de Certification Électronique sets faces an administrative sanction of a fine, a suspension of up to three hundred sixty five days, or a prohibition on operating in the Democratic Republic of the Congo, depending on the severity and impact of the breach.
When LexLint raises it
operates_essential_service
Read the law
Text of Ordonnance-loi n° 23/010 du 13 mars 2023 portant Code du numérique
reproduced by the Autorité de Régulation de l'Électricité (are.gouv.cd)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.