Law / 
Democratic Republic of the Congo
Digital Code, Book IV: Unauthorized Access to a Computer System
Code du numérique Livre IV, Sécurité et protection pénale des systèmes informatiques, Ordonnance-loi n° 23/010 du 13 mars 2023 (arts. 330 à 334)
In force since .
A computer misuse rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not access, or maintain access to, all or part of a computer system without authorization and with fraudulent intent.
- Do not exceed your lawful access authority over a computer system with fraudulent intent or intent to harm.
- Do not suppress, obtain, or modify data in a computer system, or alter its functioning, through unauthorized access.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Unauthorized or fraudulent access to a computer system draws three to five years' penal servitude and a fine of 50 to 100 million Congolese francs (Article 332); the penalty rises to five to ten years and 100 to 300 million francs where data is altered or removed (Article 333, first paragraph), and to ten to twenty years and 300 to 550 million francs where security measures are breached (Article 333, second paragraph).
Penalty structure
Article 332 sets a base fine of 50,000,000 to 100,000,000 Congolese francs (three to five years' penal servitude) for unauthorized access or exceeding lawful access authority. Article 333 raises this to 100,000,000 to 300,000,000 francs (five to ten years) where the access alters or removes data or system functioning, and to 300,000,000 to 550,000,000 francs (ten to twenty years) where the access breaches security measures.
- Rule
- Fixed only
- As of
- Minimum
- 50,000,000
- Currency
- CDF
- Fixed cap
- 550,000,000
What it makes you log
Logging duty
Articles 330 to 334 define offences: unauthorized access to or remaining in a computer system with fraudulent intent, exceeding a lawful power of access, aggravated penalties where data is suppressed, obtained or modified or a security measure is violated, and interception or misuse of data in non-public transmission. They impose no duty to create, keep, produce or review a log or record, and name no audit, no auditor and no one who may demand a record. The articles state no territorial hook.
- Kind
- None
- As of
What this law does
Article 330 makes any violation of the Digital Code punishable under a penalty it provides a criminal offence against the digital legislation.
Article 332 punishes with three to five years' penal servitude and a fine of 50,000,000 to 100,000,000 Congolese francs, or either penalty alone, whoever intentionally and without right accesses or maintains access, with fraudulent intent, to all or part of a computer system, and punishes with two to five years' penal servitude and the same fine whoever, with fraudulent intent or intent to harm, exceeds their lawful access authority over a computer system.
Article 333 raises the penalty to five to ten years' penal servitude and a fine of 100,000,000 to 300,000,000 Congolese francs where the access results in the suppression, obtaining, or modification of data in the system, or an alteration of the system's functioning, and to ten to twenty years' penal servitude and a fine of 300,000,000 to 550,000,000 Congolese francs where the same conduct breaches security measures.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .