Ordonnance-Loi n° 23/010 du 13 mars 2023 portant code du numérique (Decree-Law No. 23/010 of 13 March 2023 on the Digital Code)

Ordonnance-Loi n° 23/010 du 13 mars 2023 portant code du numérique (Decree-Law No. 23/010 of 13 March 2023 on the Digital Code) is the Democratic Republic of the Congo's primary legislation governing the digital economy, electronic services, cybersecurity, electronic transactions, and the protection of personal data. Enacted under executive authority as an ordonnance-loi (decree-law), it was published in the Journal Officiel de la République Démocratique du Congo on 11 April 2023. The Digital Code is a comprehensive legislative instrument, consolidating in a single text rules applicable to digital infrastructure and services, electronic certification and trust services, electronic communications, cybersecurity, electronic commerce and transactions, and personal data protection. Title III of the Code specifically addresses the protection of personal data. The data protection provisions apply to any automated or partially automated processing of personal data, as well as to non-automated processing of personal data held in a structured system, conducted within the territory of the DRC or relating to data subjects located in the DRC. The law extends to controllers and processors established outside the DRC where their activities are directed at persons in the DRC. The Code establishes the foundational principles for data processing, including lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, and security, and sets out the rights of data subjects, including rights of access, rectification, and erasure. Controllers are required to implement appropriate technical and organisational security measures and are obliged to report data breaches to the supervisory authority. Article 262 of the Code provides for the establishment of an independent personal data protection supervisory authority. As at June 2026, this authority had not been formally constituted by the required Prime Ministerial decree. A 2024 ministerial decree provisionally transferred supervisory functions to the Autorité de Régulation du Numérique (ARN), though this arrangement has been questioned by legal practitioners as potentially ultra vires. The Code also establishes the ARN for digital market regulation, the Agence Nationale de Cybersécurité (ANC) for cybersecurity, and the Autorité Nationale de Certification Électronique (ANCE) for trust services and digital certification. In June 2025, the DRC ratified the African Union Convention on Cybersecurity and the Protection of Personal Data (the Malabo Convention). Under Congolese constitutional law, ratified treaties take precedence over ordinary domestic law, reinforcing the obligation to establish a dedicated and functional data protection regime. Note: The brief characterised the DRC as having a 'draft bill under development.' Current status as at June 2026 is that the Digital Code (which includes personal data protection provisions) is enacted and in force. No standalone data protection bill separate from the Digital Code has been identified. The absence of an operational supervisory authority remains the key implementation gap. Original language: French.

1. 1Title III establishes personal data protection provisions applicable to all automated and non-automated processing in the DRC or directed at DRC data subjects
2. 2Controllers must observe principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, and security
3. 3Data subjects hold rights of access, rectification, and erasure; mandatory breach notification to the supervisory authority is required
4. 4Article 262 creates a personal data protection supervisory authority; as at June 2026, it has not been formally constituted by Prime Ministerial decree, provisional oversight transferred to ARN by ministerial decree (2024)
5. 5Cross-border data transfers are subject to conditions requiring equivalent protection in the receiving jurisdiction
6. 6DRC ratified the AU Malabo Convention on Cybersecurity and Personal Data in June 2025, reinforcing international data protection obligations
7. 7Digital institutions established by the Code: ARN (digital regulation), ANC (cybersecurity), ANCE (electronic certification)
8. 8Cybercrime offences: the Code criminalises attacks on the confidentiality, integrity and availability of information systems (unauthorised access, data interference, unlawful interception), computer fraud and forgery, phishing (hameçonnage), electronic harassment, and the initiation or relaying of false information via social media/ICT networks (Art. 360), with criminal liability extending to legal persons
9. 9Telecoms/electronic communications: the Digital Code regulates electronic communications networks and services and provides three graduated market-entry regimes, licence, authorisation and declaration
10. 10Regulatory architecture: the ARN regulates the digital market under the Code, alongside the long-standing sector regulator ARPTC (Autorité de Régulation de la Poste et des Télécommunications du Congo) for post and telecommunications
11. 11Provides for management of scarce resources (radio-frequency spectrum and numbering), interconnection and access between operators, and network infrastructure obligations
12. 12Imposes data-hosting/localisation requirements for defined categories of data to support the DRC's digital sovereignty