Digital Code, Livre II: Trust Service Provider Security-Incident Notification

Code du numérique, Livre II, Titre II, Chapitre III, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 148 et 149)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 13 March 2023.

A vulnerability and incident reporting rule binding public and private bodies.

As of 19 September 2026.

What it requires

This binds a qualified or non-qualified trust service provider (prestataire de services de confiance), an electronic certification service provider, regardless of whether it is public or private.
Notify the Autorité Nationale de Certification Électronique, and where applicable other bodies concerned, within twenty four hours of becoming aware of it, of every breach of security or loss of integrity having a significant impact on the trust service provided or on the personal data it stores.
Where the breach or loss of integrity is liable to harm a user of the service, notify that user as well, within twenty four hours.
Expect the Autorité Nationale de Certification Électronique to be able to require you to inform the public of the breach, or to inform the public itself, whenever it finds the public interest requires it.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Article 164 frames the sanction for a trust service provider's noncompliance with the ordonnance-loi, including the Article 148 and 149 notification duties, as an administrative one (a fine, a service suspension, or a prohibition on operating), not a criminal offense; the section carrying Article 164 is captioned Des sanctions administratives.

Penalty structure

Article 164 tiers the administrative sanction on a trust service provider by the impact of the breach: a suspension of service for ninety to three hundred sixty five days and/or a fine of 500,000 to 5,000,000 Congolese francs where the impact is limited to the certificate holder, a fine of 10,000,000 to 50,000,000 Congolese francs where the impact touches the integrity of holders' personal data, and a prohibition on operating in the Democratic Republic of the Congo where the breach touches national defense or state security. Article 164 applies to a trust service provider's noncompliance with the ordonnance-loi generally, including the Article 148 and 149 notification duties, and is not confined to those two articles.

Rule: Fixed only
As of: 19 September 2026
Minimum: 500,000
Currency: CDF
Fixed cap: 50,000,000

Who enforces it

Enforcement body

L'Autorité Nationale de Certification Électronique.

Settledness

As of: 19 September 2026
Open questions: What form must the Article 148 notification to the Autorité Nationale de Certification Électronique take beyond the statute's own "par tout moyen" (by any means) wording?

What it reaches

Obligation class

Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 148 requires a qualified or non-qualified trust service provider to notify the Autorité Nationale de Certification Électronique, and where applicable other bodies concerned, within twenty four hours of becoming aware of it, of every breach of security or loss of integrity having a significant impact on the trust service provided or on the personal data it stores.

Article 149 requires the trust service provider to notify the same breach or loss of integrity to an affected user within twenty four hours where it is liable to harm that user. Article 149 requires the Autorité Nationale de Certification Électronique, on receiving a notification concerning a foreign State, to inform the competent authorities of that State beforehand.

Article 149 lets the Autorité Nationale de Certification Électronique inform the public of the breach, or require the trust service provider to do so, whenever the Authority finds the public interest requires it.

When LexLint raises it

operates_essential_service

Read the law

Text of Ordonnance-loi n° 23/010 du 13 mars 2023 portant Code du numérique
reproduced by the Autorité de Régulation de l'Électricité (are.gouv.cd)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app