Congo (Democratic Republic)

The Democratic Republic of the Congo's comprehensive data-protection regime is Titre III (Des donnees personnelles) of the Ordonnance-loi n° 23/010 du 13 mars 2023 portant Code du numerique, signed by President Felix-Antoine Tshisekedi Tshilombo at Kinshasa and in force from its own date of promulgation, 13 March 2023.

It binds the State, provinces, decentralised and deconcentrated territorial entities, and any public or private legal person or natural person, over automated or non-automated processing of personal data carried out on national territory or abroad, subject only to a narrow personal-or-domestic-use exclusion, a temporary-caching exclusion for network transmission, and a separate regime for processing by competent authorities for criminal-law-enforcement purposes.

Processing is lawful only where the data subject has consented or the processing is necessary to perform a legal obligation, and processing of racial, ethnic, political, religious or philosophical, refugee or stateless, trade-union, sex-life or health data is prohibited subject to enumerated exceptions (consent, vital interest, public interest, statistics, preventive medicine).

A prior declaration to the Data Protection Authority is required for most processing, and prior authorisation is required before processing genetic, medical or research data, offence or conviction data, a national identification number or telephone number, biometric data, or before any cross-border transfer. Titre IV creates the Autorite de Protection des Donnees (APD), an independent administrative authority with legal personality, to enforce Titre III.

Personal data must be stored in the Democratic Republic of the Congo; transfer to a digital embassy, a third-country host, or an international organisation is permitted only where the APD finds an adequate level of protection, which functions as a data-localisation default rather than a merely 'moderate' cross-border-transfer posture, correcting the jurisdiction's prior attribute value to 'strict'.

A data breach must be notified to the APD and to the affected person without delay, with no fixed numerical deadline stated. Administrative sanctions for a Title III breach range from 8,000,000 to 200,000,000 Congolese francs where the violation caused no serious harm, escalating to 5% of annual turnover or an order to cease processing for the gravest violations, and the State separately reserves the right to bring a criminal action.

Loi n° 20/017 du 25 novembre 2020 relative aux telecommunications et aux technologies de l'information et de la communication was named as a possible source of additional confidentiality duties for the telecommunications sector, but its primary text was not located, so no telecommunications-sector privacy instrument is recorded here.

The Democratic Republic of the Congo has no dedicated scraping or web-crawling statute, but Livre IV (De la securite et de la protection penale des systemes informatiques) of the Ordonnance-loi n° 23/010 du 13 mars 2023 portant Code du numerique criminalises unauthorised access to, and unauthorised maintenance of access within, a computer system, reaching an automated crawler or agent that accesses a system without authorisation and with fraudulent intent.

There is no reported case construing how 'authorization' is read for a public web page, and no robots.txt-specific or AI-training-specific provision.

Ordonnance-loi n° 86-033 du 5 avril 1986 portant protection des droits d'auteur et des droits voisins (see the aggregation topic for this jurisdiction) contains no text-and-data-mining exception and no database (sui generis) right; its Article 375, read there, separately criminalises a deliberate, commercial-scale infringement of copyright committed by means of a computer system, which reaches large-scale reproduction of copyrighted material by an automated system.

Loi n° 20/017 du 25 novembre 2020 relative aux telecommunications et aux technologies de l'information et de la communication was named as a possible source of network-access offences, but its primary text was not located, so no instrument from that law is recorded here.

The Democratic Republic of the Congo has no press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, and no text-and-data-mining opt-out mechanism.

Ordonnance-loi n° 86-033 du 5 avril 1986 portant protection des droits d'auteur et des droits voisins, in force since its own date of promulgation, 5 April 1986, gives an aggregator two free-use provisions instead: a general quotation exception for citations or excerpts of a protected work reproduced for a cultural, scientific, teaching, critical or polemical purpose, and a press-specific exception letting the written or spoken press reproduce an article published in a newspaper or journal, on named-source condition, unless the article or periodical itself states that reproduction is forbidden, plus an unconditional free-use rule for 'news of the day' and miscellaneous facts having the character of mere press information.

Loi n° 23/009 du 3 mars 2023 fixant les regles relatives a l'exercice de la liberte de la presse, which replaced the 1996 press law and was named as a possible source of republication or licensing rules, was not located, so no finding is recorded from it.