Republic of the Congo

Art. 18 requires any operator of an information system or electronic communications network to tell the agency of attacks, intrusions or other disruptions that could affect another system, without delay; no fixed deadline in hours or days was seen.

Art. 5 makes prior consent the general basis for processing, with listed exceptions; Art. 46 requires information to data subjects at collection; Art. 50 gives access, Art. 56 portability, Art. 59 objection and Art. 60 rectification, updating or deletion.

Art. 74 requires controllers to notify the Commission without undue delay and, where possible, within 72 hours of awareness, unless the breach is unlikely to create a risk; Art. 77 requires notice to data subjects where the risk is high.

Art. 91 guarantees safety for whistleblowers, witnesses and experts; Art. 107 bars exclusion from recruitment and the sanction or dismissal of employees for reporting offences; Art. 96 sets 5 to 10 years' imprisonment and a fine of 3,000,000 FCFA for retaliation. Art. 119 also requires heads of credit and financial institutions to report relevant facts to the HALC.

Art. 15 requires reporting entities to have policies, procedures and controls, including a money laundering control officer at management level and an independent audit function. Art. 27 requires internal policies approved by the policy organ and Art. 28(d) lists appointment of a compliance officer.

Art. 39 requires financial institutions to keep identity records for at least ten years from account closure or end of the relationship, and transaction records for at least ten years after the transaction.

Art. 20 requires identification and verification of customers and beneficial owners before a business relationship begins; Art. 21 requires ongoing vigilance and bars anonymous or fictitious accounts; Art. 33 covers beneficial owners. Under Art. 41 an institution that cannot complete due diligence must not open the account or carry out the transaction.