CevroDR Congo: Digital Code (Ordinance-Law 23/010 of 2023) and what it requires
Digital Code (Ordinance-Law 23/010 of 2023): a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by ARPTC (dedicated data protection authority planned).
Key requirements at a glance
| Registration with the regulator | Depends on thresholds or circumstances |
|---|---|
| Data protection officer | Not required |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Depends on thresholds or circumstances |
| Data localization | Not required |
Penalties and enforcement
Not yet fully specified — the framework is still maturing.
What to know in practice
Consent-based processing and data-subject rights are established in law; a dedicated data protection authority is still being stood up.
How Cevro helps
- Maps Digital Code (Ordinance-Law 23/010 of 2023) to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in DR Congo?
ARPTC (dedicated data protection authority planned) oversees Digital Code (Ordinance-Law 23/010 of 2023).
Is breach notification mandatory under Digital Code (Ordinance-Law 23/010 of 2023)?
Our reference does not record a fixed hourly deadline for Digital Code (Ordinance-Law 23/010 of 2023). Check the statute and ARPTC (dedicated data protection authority planned) guidance for the notification timing that applies to you.
Does DR Congo restrict cross-border data transfers?
Conditionally. Transfers are restricted in some circumstances, so check whether your data flows trigger the rules before relying on them.
Do you need a data protection officer under Digital Code (Ordinance-Law 23/010 of 2023)?
It is not a general requirement in our reference, though naming an accountable person is still good practice.
What are the penalties for non-compliance in DR Congo?
Not yet fully specified — the framework is still maturing.