Republic of the CongoLaw No. 29-2019, sanctions
Loi n° 29-2019, articles 92 à 98 (sanctions administratives et pénales)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Expect the national commission to issue a warning, or a formal notice fixing a period to remedy a failure to meet the Law's obligations, before any sanction follows.
- Expect the commission, after adversarial procedure, to withdraw an authorization, ban processing for up to three months or permanently, order you to cease processing, or impose an administrative fine of one million to one hundred million CFA francs, where you do not comply with its formal notice.
- Expect the commission, in an emergency, to order the interruption of processing or the locking of data for up to three months, or a temporary or permanent prohibition, where the processing violates rights and freedoms.
- Expect the commission's sanctions and decisions to be open to appeal before the Supreme Court.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 98 provides that infringement of the Law's provisions is punished under the Penal Code and under Law No. 27-2020 on combating cybercrime; that cybercrime law's Chapter 6 (Articles 12 to 22) separately criminalises processing without the required formalities, undeclared or unauthorised processing, processing of special-category data, and unlawful data collection, each with imprisonment of one to five years and a fine of one million to ten million CFA francs.
Penalty structure
Article 93 empowers the commission to impose, in addition to a warning, compliance order, temporary suspension of up to three months, or a definitive withdrawal of authorization or ban on processing, an administrative fine of one million (1,000,000) to one hundred million (100,000,000) CFA francs, recovered under State debt-recovery law. Criminal penalties for the same conduct are set separately by the Penal Code and Law No. 27-2020 on combating cybercrime (see criminal_exposure_note).
- Rule
- Fixed only
- As of
- 7 September 2026
- Minimum
- 1,000,000
- Currency
- XAF
- Fixed cap
- 100,000,000
Who enforces it
Enforcement body
The national commission for the protection of personal data the Law establishes and empowers to receive declarations, grant authorizations, and impose sanctions
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 92 lets the national commission issue a warning to a controller failing to meet the Law's obligations, or a formal notice to remedy a breach within a period the commission fixes.
Article 93 lets the commission, where the controller does not comply with that formal notice and after adversarial procedure, order a provisional withdrawal of authorization or a provisional ban on processing not exceeding three months, a definitive withdrawal of authorization or ban on processing, an injunction to cease processing subject to the declaration regime or the article 32 and 33 exemptions, or an administrative fine of one million to one hundred million CFA francs, recovered under the legislation on the recovery of State debts.
Article 94 lets the commission, in an emergency where a processing operation or the exploitation of personal data violates rights and freedoms, order, after adversarial procedure, the interruption of the processing or the locking of the data concerned for up to three months, or a temporary or permanent prohibition of processing contrary to the Law.
Article 95 requires the commission's sanctions to rest on a report by one of its members, notified to the controller, who may submit observations and be represented or assisted. Article 96 lets the commission's president make its sanctions public and order their publication, at the sanctioned person's expense, in the publications, newspapers or media the president designates. Article 97 opens a right of appeal against the commission's sanctions and decisions before the Supreme Court.
Article 98 provides that breach of the Law's provisions is separately punished under the Penal Code and under Law No. 27-2020 on combating cybercrime, whose own Chapter 6 criminalises processing without the required formalities, unlawful or undeclared processing, and processing of special-category data, each with imprisonment of one to five years.
Article 101 requires the Law's publication in the Journal Officiel de la République du Congo and its execution as law of the State, and it was signed at Brazzaville on 10 October 2019. The Journal Officiel de la République du Congo published the Law in its No. 45-2019 issue of Thursday, 7 November 2019, and no provision of the Law defers its own entry into force to a later date.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbothigh_risk_decisions
Read the law
Text of Law No. 29-2019
published in the Journal Officiel de la République du Congo No. 45-2019, reproduced by the Secrétariat Général du Gouvernement (sgg.cg)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.