DRC Introduces New Authorization Rules for Key Digital Services

The Democratic Republic of Congo (DRC) has introduced a new regulatory framework targeting selected digital activities and services. In an order signed on March 11, 2026, Digital Economy Minister Augustin Kibassa Maliba set out procedures for reviewing applications and issuing authorizations under the country’s Digital Code.

The new rules apply only to activities that require prior approval. Operators affected by the measure have until June 30, 2026, to comply, with full enforcement beginning on July 1.

The scope of the regulation is focused rather than broad. It covers operators involved in building data centres, as well as qualified trust service providers offering services such as electronic signatures, seals, timestamping, certification, archiving, website authentication, electronic registered mail, and cryptology. Application hosting providers are also included, along with a range of larger digital platforms. These include cloud services, online marketplaces, app stores, social networks, content-sharing platforms, online banking platforms, fintech companies, matchmaking platforms, search engines, and other essential digital services.

During the transition period, the Postal and Telecommunications Regulatory Authority of Congo (ARPTC) will handle the review of applications. The regulator will assess whether submissions are complete and compliant, and evaluate applicants’ legal, technical, organisational, and financial capacity. It will then issue recommendations to the minister, who retains final authority on approvals.

Authorization Requirements and Validity

Applicants are required to submit detailed documentation, including legal, tax, technical, and administrative records, alongside a description of their activities and a business plan.

Authorizations will be valid for five years and can be renewed. However, holding an authorization does not exempt operators from complying with other applicable laws and regulations.

The order also outlines administrative penalties for non-compliance. These include fines, shortened authorization periods, suspension, or withdrawal of approval. Operators that provide services without the required authorization may face additional penalties under existing laws.