Law / 
Democratic Republic of the Congo
Digital Code, Title III, cross-border transfer of personal data
Code du numérique, Titre III, arts. 201 à 203 (transfert des données personnelles)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Licensing
- Audit expectation
- periodic
- Who audits it
- Regulator
What it requires
- Store personal data in the Democratic Republic of the Congo, and do not transfer it to a third country, digital embassy, or international organization unless the Data Protection Authority finds an adequate level of protection.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkID.IM-P7
- Obtain the Data Protection Authority's prior authorization before any actual transfer of personal data to a third country or international organization, even after an adequacy finding.NIST Privacy FrameworkCT.PO-P2
- Where the destination does not offer an adequate level of protection, transfer personal data only with the data subject's informed, explicit consent, or where the transfer is necessary to perform a contract, protect vital interests, serve an important public interest, or establish a legal claim, and not for a public authority's own exercise of public power.NIST Privacy FrameworkCT.PO-P2
- Where no adequacy finding and no article 202 ground applies, seek the Council of Ministers' authorization, on the Data Protection Authority's conforming opinion, by offering sufficient guarantees for privacy and fundamental rights.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P7The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 201 to 203 require personal data to be stored in the Democratic Republic of the Congo, bar transfer unless the Data Protection Authority finds adequate protection and gives prior authorization, and list the derogations. None of them asks the controller for a log, register or record of the transfers. Article 201 does subject every transfer to regular control by the Authority, which is coded as a continuous check by the regulator because the text sets no schedule and no trigger.
- Kind
- None
- As of
What this law does
Article 201 requires personal data to be stored or hosted in the Democratic Republic of the Congo, and permits transfer to a digital embassy, a host in a third State, or an international organisation only where the Data Protection Authority finds that the destination offers a level of protection equivalent and sufficient to Titre III's own, assessed against the rule of law and human rights, the general and sector legislation and the remedies available there, the existence of independent supervisory authorities, and the destination's international commitments on data protection; a controller must obtain the Authority's prior authorisation before any actual transfer, and every transfer remains subject to the Authority's regular control.
Article 202 lets a controller transfer personal data to a destination that does not meet that adequacy standard only where the data subject has given informed, explicit consent to the transfer, the transfer is necessary to perform or negotiate a contract with the data subject or in the data subject's interest, an important public interest or a legal claim requires it, the data subject's or another person's vital interests require it and the data subject cannot consent, or the transfer originates from a public register open to legitimate consultation, and it bars public authorities from relying on the first three of those grounds when they exercise their own public powers.
The same article lets the Council of Ministers, on the Authority's conforming opinion, authorise a transfer or a set of transfers to a destination that offers adequate and sufficient protection where the controller offers sufficient guarantees for privacy and fundamental rights, and it keeps the complete register of criminal convictions under the Authority's control and its custodians under professional secrecy.
Article 390 enters the ordinance-law into force on the date of its own promulgation, and it was signed at Kinshasa on by President Félix-Antoine Tshisekedi Tshilombo.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .