Law / 
Democratic Republic of the Congo
Digital Code, Title III, personal data breach notification
Code du numérique, Titre III, art. 244 (violation de données à caractère personnel)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- Notify the Data Protection Authority and the affected data subject without delay of any breach affecting personal data, describing the nature of the breach, the categories and approximate number of affected people and records where possible, a contact point, the likely consequences, and the measures taken or proposed to address it.
- As a processor, warn the controller without delay of any breach of security affecting personal data you process on the controller's behalf.
- Communicate the breach to the affected data subject unless you had applied protective measures such as encryption that render the data unintelligible, you have since eliminated the high risk to their rights and freedoms, or it would require disproportionate effort, in which case make a public communication or an equally effective measure instead.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 244 requires the controller to notify the Data Protection Authority and the data subject of a breach without delay, requires the processor to warn the controller, and lists what the notice must describe. It does not require the controller to document or register the breach, so it is a duty to notify and not a record duty, and no audit of a record is named.
- Kind
- None
- As of
What this law does
Article 244 requires the controller to notify the Data Protection Authority and the affected data subject, without delay, of any breach that has affected the data subject's personal data, and states no fixed number of hours or days for either notification. The same article requires a processor to warn the controller without delay of any breach of security affecting personal data it processes on the controller's behalf.
The notification must, at a minimum, describe the nature of the breach including, where possible, the categories and approximate number of affected data subjects and of personal data records concerned, give the name and contact details of the data protection officer or another contact point, describe the likely consequences, and describe the measures taken or proposed to address the breach.
Communicating the breach to the affected data subject is not required where the controller had applied protective measures, in particular ones that render the affected data unintelligible to an unauthorised person, such as encryption, where the controller has since taken measures that mean the high risk to the data subject's rights and freedoms is no longer likely to materialise, or where it would require disproportionate effort, in which case a public communication or an equally effective measure is made instead.
Article 390 enters the ordinance-law into force on the date of its own promulgation, and it was signed at Kinshasa on by President Félix-Antoine Tshisekedi Tshilombo.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .