Law / Congo (Democratic Republic)
Digital Code, Title III: Personal Data Protection
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 13 March 2023.
A comprehensive regime rule binding public and private bodies.
As of 7 September 2026.
What it requires
- Obtain the data subject's consent before processing their personal data, unless the processing is necessary to perform a legal obligation.
- File a prior declaration with the Data Protection Authority before processing personal data, or obtain its prior authorization before processing genetic, medical, biometric, offense or conviction, national-identification, or cross-border-transfer data.
- Do not process data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, refugee or stateless status, trade union membership, sex life, or health, unless a statutory exception applies.
- Store personal data in the Democratic Republic of the Congo, and do not transfer it to a third country, digital embassy, or international organization unless the Data Protection Authority finds an adequate level of protection.
- Obtain the consent of the holder of parental responsibility before offering an information-society service directly to a minor.
- Notify the Data Protection Authority and the affected person without delay of any breach affecting personal data.
If you get it wrong
Penalty structure
Article 257 sets the base administrative fine at 8,000,000 to 200,000,000 Congolese francs where the violation caused no serious harm to the State or to the persons concerned. The same article separately empowers the Data Protection Authority to impose a payment of 5% of the responsible party's annual turnover, or an order to cease processing, for the gravest violations (those causing death or attempted murder, or endangering national security or safety), and reserves the State's separate right to bring a criminal action and claim damages.
- Rule
- Fixed only
- As of
- 7 September 2026
- Minimum
- 8,000,000
- Currency
- CDF
- Fixed cap
- 200,000,000
Who enforces it
Enforcement body
L'Autorité de Protection des Données (APD), the independent administrative authority Titre IV of the Digital Code creates to enforce Titre III
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Breach notice, Transfer, Licensing, Biometric
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 184 subjects to Titre III the collection, processing, transmission, storage and use of personal data by the State, provinces, decentralised and deconcentrated territorial entities, public or private legal persons and natural persons, whether the processing takes place on national territory or abroad.
Article 185 excludes only processing by a natural person for exclusively personal or domestic activities where the data is not communicated to third parties or disseminated, temporary caching copies made for network transmission, and processing by competent authorities for the prevention, investigation and prosecution of criminal offences. Article 186 requires a prior declaration to the Data Protection Authority for most processing.
Article 187 requires prior authorisation before processing genetic, medical or scientific-research data, offence or conviction data, a national identification number or telephone number, biometric data, data processed for a public-interest historical, statistical or scientific purpose, or before any cross-border transfer. Article 192 makes processing lawful only where the data subject has consented or the processing is necessary to perform a legal obligation.
Article 195 prohibits processing of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, refugee or stateless status, trade-union membership, sex life, or health, subject to exceptions for manifestly public data, explicit consent, vital interest, public interest, public statistics, and preventive or occupational medicine.
Article 201 requires that personal data be stored in the Democratic Republic of the Congo, permitting transfer to a digital embassy, a host in a third State, or an international organisation only where the Data Protection Authority finds that the destination offers a level of protection equivalent and sufficient to Titre III's own.
Article 244 requires the data controller to notify the Data Protection Authority and the affected person, without delay, of any breach affecting personal data, without stating a fixed numerical deadline. Article 247 conditions any information-society service offered directly to a minor on the consent of the holder of parental responsibility over that minor.
Article 262 creates the Autorite de Protection des Donnees (APD), an independent administrative authority with legal personality, financial autonomy, and its organisation fixed by a decree of the Prime Minister, to enforce Titre III.
Article 257 empowers the APD to impose an administrative fine of 8,000,000 to 200,000,000 Congolese francs where a breach caused no serious harm to the State or to the persons concerned, rising to 5% of the responsible party's annual turnover or an order to cease processing for the gravest violations, and reserves the State's separate right to bring a criminal action and claim damages against the controller.
When LexLint raises it
crawls_webtrains_modelsautomated_outreachprocesses_biometrics
Read the law
Text of Ordonnance-loi n° 23/010 du 13 mars 2023 portant Code du numérique
reproduced by the Autorité de Régulation de l'Électricité (are.gouv.cd)