Congo Law 29-2019 on Data Protection
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | CG Law 29 |
| Region | Middle East & Africa |
| Country or scope | Republic of the Congo |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers CG Law 29
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
CG-29-SEC Protective Security Measures | Organizations must implement protective measures, including encryption, to prevent unauthorized access, loss, or alteration of personal data; integrity hashes across processing components evidence those measures (Law 29-2019, security-of-processing obligations) | Scan |
CG-29-ACC Accurate, Purpose-Bound Data | Processing must be limited to specified, legitimate purposes with accurate data, presuming each processing component is fully identified by both name and a concrete version (Law 29-2019, processing principles) | Scan |
CG-29-PROC Third-Party and Transfer Accountability | Data may reach third parties or cross borders only under adequate safeguards, so third-party software components must carry named, accountable suppliers (Law 29-2019, third-party and cross-border transfer provisions) | Scan |
CG-29-INV Processing Software Inventory | Controller obligations under the law presuppose an enumerable, named inventory of the software components that collect and process personal data (Law 29-2019, controller obligations) | Scan |
CG-29-BREACH Compromise Assessment Readiness | Safeguarding personal data against loss or unauthorized access requires that processing components are identifiable via standard identifiers so any compromise can be scoped (Law 29-2019, data-security obligations) | Scan |
CG-29-TRANS Transparent Processing | Processing must be transparent to data subjects, presupposing documented, uniquely identified and timestamped records of the processing environment (Law 29-2019, transparency principle) | Scan |
Policy templates
All 22 from the standard set, adapted to CG Law 29.
Chad Law No. 007/PR/2015 on Protection of Personal Data
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
Cote d'Ivoire Law No. 2013-450 on Personal Data
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.