Congo-Brazzaville Law 29-2019 and AI: building governance that holds

In Pointe-Noire, the office manager of a port logistics company uses ChatGPT to draft letters to clients and summarise shipping files. In Brazzaville, a bank officer does the same with credit notes. Nobody has told them what they can put in, or what they should keep to themselves.

Many organisations in the Republic of the Congo are in that position. Generative AI reached the office faster than internal rules did. Yet the country has had a personal data law since 2019, and it offers a solid basis for organising these uses.

Law 29-2019, the backbone of the Congolese framework

Law No. 29-2019 of 10 October 2019 on the protection of personal data sets the rules for any organisation that collects or processes data about people in the Congo. It rests on familiar principles: prior and explicit consent, unless an exception applies, a defined purpose, security and confidentiality.

The text goes into detail. It requires prior declaration of processing, authorisation for some sensitive data, the appointment of a data protection officer in several cases, and notification of data breaches within 72 hours.

An authority on its way, obligations already here

The law gives oversight to a national commission for the protection of personal data. In July 2024, the Council of Ministers adopted a draft bill to create this commission, a necessary step to make it operational.

That delay does not suspend the law. The duties of security, confidentiality and limits on transfers apply, and so do the criminal penalties it provides. Companies that wait for the commission to be set up before acting take a risk: having to put everything in place in a rush, under the eye of a brand new regulator.

Why generative AI is a governance problem

The first issue is not technical. It is organisational. In most companies, nobody is clearly responsible for AI use. Teams pick their own tools, often on personal accounts. We put figures on this shadow AI in our article on the real cost of shadow AI.

Law 29-2019 also strictly governs transfers: data may only leave the Congo for a country with comparable protection, with prior notice to the commission. A prompt sent to an assistant hosted abroad falls within that scope.

Without shared rules, each team sets its own limits, or none at all. Legal does not know which tools are in use, IT cannot see the flows, and management discovers the problem on the day of an incident. Clear governance is first of all about sharing out roles.

The Brazzaville and Pointe-Noire context

The country's two economic hubs do not face quite the same issues.

• Brazzaville is home to the government, bank headquarters and telecom operators. The data there is mostly customer, user and civil servant records.

• Pointe-Noire lives on oil, the port and logistics. It holds staff data, occupational health data, contracts and shipping documents, often shared with foreign partners.

In both cities, teams juggle French, Lingala and Kituba and use AI to translate or rephrase. That means more internal documents copied and pasted into chatbots.

Five pillars of AI governance

1. A named owner. The data protection officer, or failing that the CIO, owns the AI use policy and reports to management.

2. A short written policy. Which tools are allowed, for what, and which data must never be entered: identities, account numbers, medical files, civil servant data.

3. A map of processing. Every regular AI use goes into the register, with its legal basis and any transfer out of the Congo.

4. Technical control on the device. Training alone is not enough, as we explain in why AI security training doesn't work. You need a tool that spots sensitive data at the moment of the prompt, then anonymises it or blocks the upload.

5. Evidence and metrics. Incidents prevented, tools used, teams involved. These will matter in front of the future commission and if a breach has to be reported.

A realistic timeline

There is no need to do everything at once. A first month can be enough to name an owner, publish a policy and start the inventory. The next two months are for deploying control on the most exposed devices, then extending it. Our 90-day rollout playbook details this progression. To compare with a French speaking country whose regulator is already active, see our guide to Senegal's Law 2008-12.

Key takeaways

• Law 29-2019 already governs personal data use in the Congo, including in AI tools.

• The national commission is being created, but the obligations apply now.

• A prompt to an AI hosted abroad is a transfer covered by the law.

• Good governance combines an owner, a policy, a register, device level control and evidence.

ZeusLock provides the device level control: it detects and anonymises sensitive data before it is sent to ChatGPT, Copilot or Gemini, and logs incidents for your audits. Book a demo to build your AI governance.