Data protection & privacy law in DR Congo (2026)

Legal framework

Ordonnance-loi n° 23/010 du 13 mars 2023 portant Code du Numérique (Digital Code); supervisory functions temporarily held by ARPTIC pending formal establishment of the dedicated Autorité de Protection des Données (APD)

Key points: data & privacy in DR Congo

1. 01Digital Code scope

   The Digital Code governs all digital activities and services carried out from or to the DRC by any natural or legal person, regardless of nationality or place of establishment. Title III contains the personal data protection regime covering collection, processing, storage, transfer, and data subject rights.

   dlapiperdataprotection.com dig.watch clinregs.niaid.nih.gov

2. 02Supervisory authority (APD / ARPTIC)

   The Digital Code legally creates an independent Autorité de Protection des Données (APD) empowered to issue opinions, conduct investigations, and impose sanctions. As of 2025, no prime-ministerial decree has formally established the APD; a ministerial decree of August 2024 temporarily transferred APD functions to ARPTIC (Autorité de Régulation des Postes, Télécommunications et TIC).

   pfkandolo-avocats.com blog.africadataprotection.org droitnumerique.cd

3. 03Data subject rights & controller obligations

   Controllers must obtain consent before processing, respect principles of purpose limitation and data minimisation, and honour data subject rights of access, rectification, and erasure. The Code also imposes obligations on subcontractors/processors and covers electronic evidence and advertising.

   dlapiperdataprotection.com dataprotection.africa ecomafrica.org

4. 04Cross-border data transfers

   Transfers of personal data outside DRC are generally prohibited unless the destination country provides equivalent protection or the competent digital ministry grants explicit authorisation, a requirement significantly more restrictive than many peer frameworks.

   dlapiperdataprotection.com dataprotection.africa

5. 05Sanctions

   The APD (acting through ARPTIC in the interim) may impose financial penalties of 8 million to 200 million Congolese francs for non-compliance, as well as formal notices, injunctions to halt processing, and referrals to law enforcement.

   pfkandolo-avocats.com dlapiperdataprotection.com

6. 06AU Malabo Convention ratification

   The DRC deposited its instrument of ratification of the African Union Convention on Cybersecurity and Personal Data Protection (Malabo Convention) with the AU Secretary-General on 27 June 2025, binding itself internationally to further strengthen its domestic data-protection framework under Article 8 of that treaty.

   cio-mag.com au.int droitnumerique.cd

Sources

1. 1.dlapiperdataprotection.com/index.html?t=law&c=CD
2. 2.dlapiperdataprotection.com/index.html?t=authority&c=CD
3. 3.dig.watch/resource/democratic-republic-of-the-congos-digital-code
4. 4.dataprotection.africa/democratic-republic-of-the-congo/
5. 5.pfkandolo-avocats.com/en/dr-congo-prospects-for-the-data-protection-authority/
6. 6.blog.africadataprotection.org/en/2024/01/31/dr-congo-outlook-for-the-data-protection-authority/
7. 7.droitnumerique.cd/regulation-du-numerique-en-rdc-larptic-investie-autorite-unique-pour-
8. 8.clinregs.niaid.nih.gov/sites/default/files/documents/DRC/DigiCode_GoogleTranslation.pdf
9. 9.au.int/en/treaties/african-union-convention-cyber-security-and-personal-data
10. 10.cio-mag.com/5-choses-a-savoir-sur-la-ratification-par-la-rdc-de-la-convention-de-
11. 11.ecomafrica.org/blog/2023/06/05/democratic-republic-of-congo-drc-has-adopted-a-digita
12. 12.droitnumerique.cd/convention-malabo-rdc/