Digital Code, Title III, sensitive personal data and minors

Code du numérique, Titre III, arts. 195 à 199, 206 et 247 (catégories sensibles et mineurs)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 13 March 2023.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, refugee or stateless status, trade union membership, sex life, or health, unless a statutory exception applies.
Rely on the data subject's explicit consent, a manifestly public disclosure by the data subject, a vital interest, an important public interest, a public authority's public-interest mission, public-statistics legislation, or supervised preventive or occupational medicine as the only grounds for processing a prohibited special category of data.
Where you cannot answer a request or a judicial or national-security requisition within the ordinary period, tell the requester the next day and answer within eight days at the latest.
Designate by function the staff who may access special-category personal data, keep that list available to the Data Protection Authority, and bind those staff to confidentiality by a legal, statutory or contractual duty.
Obtain the consent of the holder of parental responsibility before offering an information-society service directly to a minor, and verify, taking available technology into account, that the consent was given or authorized by that holder.

What it reaches

Obligation class

Prohibition, Consent, Disclosure, Age verification

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 195 prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, refugee or stateless status, trade union membership, sex life, or more generally a person's state of health, and lifts that prohibition only for data the data subject manifestly made public, the data subject's explicit consent to specific purposes, safeguarding vital interests where the data subject cannot consent, an important public interest, a public-interest mission carried out by or assigned by a public authority, execution of public-statistics legislation, and preventive or occupational medicine carried out under a health professional's supervision.

Further paragraphs the scan does not number require a controller unable to answer a data subject's request within the ordinary period to notify the requester by the next day and to answer within eight days at the latest, and let the Data Protection Authority correspond directly with a controller to obtain the information a judicial inquiry or a national-security investigation needs.

Article 206 requires a controller processing the categories this run of articles covers to designate, by function, the staff with access to the data, keep that list available to the Data Protection Authority, bind those staff to confidentiality by a legal, statutory or contractual duty, and state the legal basis for the processing whenever it informs the data subject or files its declaration.

Article 247 makes processing a minor's personal data for a direct offer of information-society services lawful only where the holder of parental responsibility over the minor has consented, and requires the controller to verify, taking available technology into account, that the consent was given or authorized by that holder.

Article 390 enters the ordinance-law into force on the date of its own promulgation, and it was signed at Kinshasa on 13 March 2023 by President Félix-Antoine Tshisekedi Tshilombo.

When LexLint raises it

crawls_web
trains_models
handles_health_records
serves_minors
deploys_chatbot

Read the law

Text of Ordonnance-loi n° 23/010 du 13 mars 2023 portant Code du numérique
reproduced by the Autorité de Régulation de l'Électricité (are.gouv.cd)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app