DRC Digital Code 2023 and AI: the new rules on personal data

In Kinshasa, a customer service team at a telecom operator handles hundreds of mobile money complaints every day. To save time, an agent copies a subscriber's history into an AI assistant and asks for a draft reply. The phone number, the name and the transaction amounts go along with it.

In the Democratic Republic of the Congo, that move no longer sits outside any rules. Since 2023, the Digital Code has contained a full personal data protection regime. Parts of it still need to be implemented, but its principles already apply to companies adopting generative AI.

The 2023 Digital Code

Ordinance-law No. 23/010 of 13 March 2023 on the Digital Code brings together in a single text the rules on electronic communications, digital trust, cybersecurity and personal data protection. It is the first time the DRC has had such a complete framework.

The Code defines personal data broadly: identity, contact details, professional, banking, billing and family data, as well as data from court decisions. Several implementing decrees are still pending, but the core obligations are in force.

Consent and sensitive data

The Code sets a strict principle. Collecting and processing personal data requires the person's prior and explicit consent, which must be provable and can be withdrawn at any time, unless the law provides an exception.

Some data may not be processed as a rule: racial or ethnic origin, political opinions, religious beliefs and health. Exceptions exist, for example with explicit consent for a specific purpose.

The Code also sets a declaration regime for processing and an authorisation regime for the most sensitive cases, such as processing national identification numbers, genetic data or criminal records, as well as transfers to third countries.

An authority still being built

The text provides for a Data Protection Authority (APD), to be created by decree of the Prime Minister. It has not yet been set up. In August 2024, a ministerial order gave its tasks on an interim basis to ARPTIC, the regulator for postal services, telecommunications and information technology, a solution some legal scholars question.

In March 2026, the Ministry of Digital Economy launched a national network of data protection officers in Kinshasa, presented as a step towards creating the authority. The signal is clear: the state is preparing to enforce the Code, and companies have every reason to get organised before the first inspections.

Three sectors on the front line

Telecoms

Operators manage tens of millions of subscribers, with their identities, locations and communications. Their call centres and marketing teams are often the first to try generative AI for sorting tickets or writing campaigns.

Mobile money

Mobile payment has become an essential service for a large part of the population. A transaction history reveals income, habits and family ties. Pasting it into a chatbot exposes financial data with no safeguard at all.

Mining

In Haut-Katanga and Lualaba, around Lubumbashi and Kolwezi, mining companies process staff files, medical data and safety reports. Many work with parent companies abroad, and their teams use AI to translate or summarise documents.

What generative AI changes in practice

A prompt containing personal data is processing under the Code. Since most AI assistants are hosted abroad, it is also a transfer out of the DRC, which the Code only allows to a country with equivalent or better protection.

In practice, these transfers happen with no consent, no declaration and no record. We describe the mechanism in our article on the anatomy of an AI data leak. The risk is even higher because teams work in French, Lingala or Swahili and use AI to switch between languages.

Getting ready before the authority arrives

1. Appoint a data protection officer, even though the Code only frames the role in general terms, and join the new national network.

2. Map AI use in customer service, finance, human resources and security.

3. Set simple rules: no subscriber number, account number or medical file in a public AI tool.

4. Protect at the source by automatically anonymising sensitive data before the prompt is sent.

5. Keep evidence of prevented incidents, which will be useful in front of the future regulator.

Format preserving anonymisation keeps the text usable for the AI while replacing the real values, as our guide to format preserving anonymization explains. To plan the work, our 90-day rollout playbook gives a realistic framework. Companies active in several French speaking countries can also compare with our guide to Senegal's Law 2008-12.

Key takeaways

• Ordinance-law 23/010 of 2023 sets a real data protection regime in the DRC.

• Explicit consent is the rule, and transfers abroad are restricted.

• The data protection authority has yet to be created, but the state is preparing for it.

• Telecoms, mobile money and mining are the most exposed to generative AI risks.

ZeusLock spots and anonymises personal data right on the device, before it reaches ChatGPT, Copilot or Gemini, and keeps a record of incidents. Book a demo to prepare your teams for the Digital Code.