Processes personal data, in the Democratic Republic of the Congo

Code du numérique, Livre IV, Titre II, Chapitre I, et Titre III, Chapitre I, Section 1, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 276 et 281) · Read the law's page

• Cooperate in detecting cyberattacks in accordance with the applicable legal and regulatory provisions.
• Inform the Agence Nationale de Cybersécurité of every attack, intrusion or other penetration liable to impair the operation of another information system or network, so as to let the Agency take the measures necessary to address it, including isolating the affected system.
• Comply with the measures the Agence Nationale de Cybersécurité prescribes to put an end to the disruption.
• This binds the operator of an information system, public or private, and more broadly any natural or legal person operating in, or possessing expertise in, the digital sector, without any sector limitation.
• No fixed numerical notification deadline is stated; the duty runs from the operator's own awareness of the attack, intrusion or penetration.

Code du numérique, Livre IV, Titre III, Chapitre I, Section 2, Ordonnance-loi n° 23/010 du 13 mars 2023 (art. 295 à 297) · Read the law's page

• This binds a digital services provider (fournisseur des services numériques) generally, regardless of the sector in which it operates.
• Implement systems qualified to detect events likely to affect the security of your own information systems; the qualification of the detection systems and of the service providers operating them is delivered by the Ministry responsible for digital affairs, the Agence Nationale de Cybersécurité having been consulted.
• Submit your information system to controls the Agence Nationale de Cybersécurité conducts to verify its security level and its compliance with security rules, at your own cost.
• Expect the Agence Nationale de Cybersécurité to be able to obtain your users' or system holders' identity, postal address and electronic address when their systems are vulnerable, threatened or attacked, so as to alert them.

Code du numérique, Titre III, Des données personnelles, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 183 à 194, 204, 205, 219, 221 à 233, 243, 245, 246 et 254) · Read the law's page

• Obtain the data subject's consent before processing their personal data, unless the processing is necessary to perform a legal obligation.
• File a prior declaration with the Data Protection Authority before processing personal data, or obtain its prior authorization before processing genetic, medical, biometric, offense or conviction, national-identification, or cross-border-transfer data.
• Keep personal data reliable, adequate, relevant, accurate and not excessive, and correct or erase it once it becomes inaccurate or incomplete.
• Do not process personal data for historical, statistical or scientific purposes beyond its original collection unless one of the statutory safeguards applies, or process only anonymous data for that further purpose.
• Implement technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or alteration, confine internal access to what each role requires, and train staff on their data protection duties.
• Build data protection into the processing by design and by default, including pseudonymization, and process by default only the personal data necessary for each specific purpose.
• Appoint a data protection officer where your processing is non-occasional, high-risk, or touches special-category or criminal-record data, and keep a written record of your processing activities available to the Data Protection Authority.
• Govern any processor's engagement by a written contract confining it to your documented instructions, and require the processor not to engage a sub-processor without your prior written authorization.
• Carry out a data protection impact assessment before processing likely to create a high risk to individuals' rights and freedoms, and consult the Data Protection Authority in advance where that assessment shows a high risk you have not sufficiently mitigated.

Code du numérique, Titre III, art. 244 (violation de données à caractère personnel) · Read the law's page

• Notify the Data Protection Authority and the affected data subject without delay of any breach affecting personal data, describing the nature of the breach, the categories and approximate number of affected people and records where possible, a contact point, the likely consequences, and the measures taken or proposed to address it.
• As a processor, warn the controller without delay of any breach of security affecting personal data you process on the controller's behalf.
• Communicate the breach to the affected data subject unless you had applied protective measures such as encryption that render the data unintelligible, you have since eliminated the high risk to their rights and freedoms, or it would require disproportionate effort, in which case make a public communication or an equally effective measure instead.

Code du numérique, Titre III, arts. 195 à 199, 206 et 247 (catégories sensibles et mineurs) · Read the law's page

• Do not process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, refugee or stateless status, trade union membership, sex life, or health, unless a statutory exception applies.
• Rely on the data subject's explicit consent, a manifestly public disclosure by the data subject, a vital interest, an important public interest, a public authority's public-interest mission, public-statistics legislation, or supervised preventive or occupational medicine as the only grounds for processing a prohibited special category of data.
• Where you cannot answer a request or a judicial or national-security requisition within the ordinary period, tell the requester the next day and answer within eight days at the latest.
• Designate by function the staff who may access special-category personal data, keep that list available to the Data Protection Authority, and bind those staff to confidentiality by a legal, statutory or contractual duty.
• Obtain the consent of the holder of parental responsibility before offering an information-society service directly to a minor, and verify, taking available technology into account, that the consent was given or authorized by that holder.

Code du numérique, Titre III, arts. 200, 207 à 218, 220, 235 à 237, 240 à 242 et 248 (droits de la personne concernée) · Read the law's page

• Give a data subject the information needed to know and contest the processing of their data on request, including confirmation of processing, the purposes, categories, recipients, retention period, and the existence of automated decision-making, and provide an access copy within sixty days.
• Give a data subject whose processing rests on consent or a contract and uses automated means their data in a structured, commonly used, machine-readable format on request, and transmit it directly to another controller where technically possible.
• Let a data subject object at any time, on legitimate grounds, to processing of their data, offer them that right expressly and free of charge before their data is first communicated to a third party or used for prospecting, and answer an objection within thirty days.
• Correct inaccurate, incomplete, ambiguous, outdated or unlawfully processed personal data on request and pass the correction on to every recipient within thirty days.
• Erase personal data on request within thirty days where it is no longer necessary, was unlawfully processed, or the data subject withdrew consent with no other legal basis remaining, and where you had made the data public, take reasonable technical steps to tell any third party processing it that erasure was requested.
• At collection, give the data subject your identity, the purposes and legal basis, the categories of data, the recipients, whether a reply is mandatory or optional, their rights of access, rectification, objection and complaint, the retention period, and any transfer to a third country; give the same information within a reasonable time when you did not collect the data from them directly.
• Do not charge a data subject for supplying information or acting on a request, and tell them in writing within thirty days if you do not act on their request.
• Tell a data subject before collecting or first using their data for information-society services aimed directly at them that they may set instructions for its management after their death.
• Where a data subject is an incapacitated adult, let their spouse or an appointed protector exercise their rights under this Title, and associate the data subject in that exercise as far as their understanding allows.

Code du numérique, Titre III, arts. 201 à 203 (transfert des données personnelles) · Read the law's page

• Store personal data in the Democratic Republic of the Congo, and do not transfer it to a third country, digital embassy, or international organization unless the Data Protection Authority finds an adequate level of protection.
• Obtain the Data Protection Authority's prior authorization before any actual transfer of personal data to a third country or international organization, even after an adequacy finding.
• Where the destination does not offer an adequate level of protection, transfer personal data only with the data subject's informed, explicit consent, or where the transfer is necessary to perform a contract, protect vital interests, serve an important public interest, or establish a legal claim, and not for a public authority's own exercise of public power.
• Where no adequacy finding and no article 202 ground applies, seek the Council of Ministers' authorization, on the Data Protection Authority's conforming opinion, by offering sufficient guarantees for privacy and fundamental rights.

Code du numérique, Titre III, arts. 234, 249 à 261 et Titre IV, arts. 262 à 270 (autorité de protection des données, sanctions et voies de recours) · Read the law's page

• Expect the Data Protection Authority to have exclusive competence over your compliance with Titre III, and to be able to delegate that control only to a body that has shown it independence, expertise, and a conflict-free structure.
• Expect a data subject to be able to complain to the Data Protection Authority, and to have a right of judicial recourse if the Authority does not act on the complaint or tell them its outcome within sixty days.
• Expect a data subject to be able to sue you or your processor before the tribunal de paix, and to be liable, jointly and severally with any other controller or processor participating in the same processing, for material or moral harm the processing caused in violation of Titre III.
• As joint controllers, allocate your respective duties by transparent agreement, including how you will handle a data subject's rights, and make the essence of that agreement available to the data subject.
• Do not obstruct the Data Protection Authority's on-site inspection, and expect a warning or a formal notice giving you no more than eight days to end a breach before a sanction follows.
• Expect an administrative fine of eight million to two hundred million Congolese francs for a violation causing no serious harm, rising to five per cent of your annual turnover where the violation caused death or an attempted murder, or an order to cease processing where it endangered national security or safety or led to a mass crime or genocide, on top of the State's separate right to bring a criminal action.
• Expect the Authority's sanctions to rest on a notified report, to have fifteen days to respond to it, and to be able to appeal a sanction before the competent administrative court; expect the Authority to make its sanctions public.