Processes personal data, in Mozambique

Art. 71(1) (categorias sensíveis), Constituição da República de Moçambique (2004) · Read the law's page

• Do not use computer means to record or process individually identifiable data on political, philosophical or ideological convictions, religious faith, party or trade union membership, or private life.

Art. 71(4) (acesso e rectificação), Constituição da República de Moçambique (2004) · Read the law's page

• Give a person access to the personal data you have collected about them, and correct it on their request.

Lei n.º 3/2017, de 9 de Janeiro, arts. 63(1)-(2), (5), 64, 65(1), (3) (dever de protecção de dados) · Read the law's page

• Keep any personal data you collect, process, or disclose electronically accurate, complete, and up to date.
• Specify the purpose for collecting personal data and your identity as the processor before collecting it, and limit any later use to that stated purpose.
• Protect personal data against risk, loss, unauthorised access, destruction, unauthorised use, modification, or disclosure.
• Do not access another party's personal data in a computerised archive, file, record, or database, and do not transfer personal data between information systems belonging to distinct services or institutions, without a legal instrument or judicial decision authorising it.
• Designate one or more individuals responsible for compliance with this chapter's data protection principles.
• Remain responsible for personal data in your possession or custody, including data you transferred to a third party for processing.

Lei n.º 3/2017, de 9 de Janeiro, arts. 63(3)-(4), (6), 65(2) (direitos do titular dos dados) · Read the law's page

• Where personal data was not collected from the data subject directly, give the subject the reason it was collected and your identity as the processor, by the time the data is first disclosed to a third party, unless notice is impossible, disproportionately burdensome, permitted by law, or the data is collected for statistical, historical, or scientific purposes.
• On a data subject's request, confirm whether their personal data is held and communicate it to them within a reasonable period on payment of a fee, and give the reasons where you refuse either request.
• Where a data subject objects to data concerning them and the objection is accepted, remove, rectify, complete, or alter it.
• Make available to any person specific information about your policies and practices for managing personal information, including who to contact with a complaint or question, how to obtain access to personal information you retain, and a description of the type of personal information retained and its general use.

Lei n.º 3/2017, de 9 de Janeiro, arts. 67(m), 68(c), 69-70 (contravenções e fiscalização) · Read the law's page

• Expect violating the data protection duties of this chapter to be treated as a punishable contravention.
• Expect a fine of 30 to 90 times the public-service minimum wage for that contravention, unless a more severe penalty applies under separate criminal legislation.
• Expect the National Institute of Information and Communication Technologies (INTIC), the law's designated regulatory entity, to process and decide the contravention proceeding.
• Expect a sanction for a contravention to be appealable directly to the judicial court of the relevant jurisdiction, or by a prior complaint to the minister overseeing information technology.

Aviso n.º 10/GBM/2021, de 22 de Dezembro (Regulamento do Número Único de Identificação Bancária), arts. 14 and 15 · Read the law's page

• If you are a credit institution or financial company, give an individual or a legal entity that asks for it clarification of the elements that led to the assignment of their Número Único de Identificação Bancária, immediately unless the matter makes that impossible.
• Update the data on which a client's Número Único de Identificação Bancária was assigned within five working days of the request, and ask the Banco de Moçambique for the corresponding updates within two working days.

Aviso n.º 12/GBM/2024, de 30 de Dezembro (Regulamento da Central de Registo de Crédito), arts. 16, 17, 18 and 19 · Read the law's page

• If you are a participating entity where a beneficiary or prospective beneficiary of credit holds or held credit, answer a request for clarification, updating or rectification of what the Central de Registo de Crédito holds about them in writing within ten days, and make the updates or rectifications needed; the period may be extended where a third entity must act, but tell the beneficiary in good time why the decision is not taken within it.
• When the credit responsibility behind a registry entry is extinguished, report the fact and, on the beneficiary's request, issue a letter or declaration of discharge; if you fail to, you answer for the costs the beneficiary incurs as a result.
• Let a beneficiary of credit who applied for, contracted, guaranteed or endorsed a credit with you request access to the information about them in the registry.

Aviso n.º 12/GBM/2024, de 30 de Dezembro (Regulamento da Central de Registo de Crédito), arts. 2, 4, 11, 13, 14, 15, 20 and 23 · Read the law's page

• If you grant credit or carry on activities directly related to credit and are under the supervision or monitoring of the Banco de Moçambique, send the Central de Registo de Crédito accurate, complete and timely information on your credit operations, within twenty-four hours of the disbursement, the creation or renewal of the limit, the constitution of the guarantee or the operation that creates the responsibility.
• Obtain the express consent of the person concerned before you consult the Central de Registo de Crédito.
• Treat the credit operations reported to the registry as secret and do not use them for purposes other than those the Regulation sets; do not pass information obtained from the registry on to third parties, except to the beneficiaries or prospective beneficiaries of credit.
• Keep all the information you sent to the registry for ten years from the extinction of the credit.

Lei n.º 13/2026, arts. 47 a 50 · Read the law's page

• Adopt a written information-security policy, a cyber-risk-management methodology, incident-notification procedures, mechanisms to prevent, correct, or mitigate cyber risk, a backup and recovery infrastructure, internal security-audit and oversight mechanisms, and a staff security-awareness and training programme.
• Name a person responsible for information security and stand up a team dedicated to detecting and responding to security incidents.
• If you are part of the Public Administration or the Private Sector at large, rather than one of the specifically named operator categories, also name an internal cybersecurity auditor, adopt an institutional information-security policy, and establish an institutional CSIRT.
• It reaches you regardless of sector or size: Article 2 covers the whole private sector and the public administration alongside named categories of infrastructure, service, and platform operator, and Article 48(2) makes the minimum security requirements below compulsory for every entity the Law covers. Article 2(2) excepts a public-administration body's actions on networks and systems for national defence, internal security, and state security, and on systems that process classified information.

Lei n.º 13/2026, arts. 57 a 66 · Read the law's page

• Notify a cybersecurity incident with a significant impact (a substantial impact, if you are an intermediary provider, a data-centre operator, or a cloud-computing-platform operator), judged by the number of users affected, duration, geographic spread, service disruption, and economic or social impact, within a deadline the National Cybersecurity Authority sets rather than the Law itself: to your sectoral CSIRT and the National CSIRT or, if you are an intermediary digital-service provider, a data-centre operator, or a cloud-computing-platform operator, to the National Cybersecurity Authority. File a monthly report on your response and resolution.
• If you operate a data centre or a cloud-computing platform, also notify your own subscribers promptly of an incident, including a data leak, that affects or may affect their content, and notify the National CSIRT of any incident or data leak you know of (in good time for a data centre, immediately for a cloud platform).
• If you operate a data centre or a cloud-computing platform, also adopt internal rules and policies for business continuity, disaster recovery, and risk management, and give your subscribers a summary of them (articles 63(1)(d) and 64(1)(d)).
• If you disclose a security vulnerability in good faith, including by giving at least 90 calendar days' notice before publishing it, the Law shields you from liability for having done so.
• It reaches you whether you are a Public Administration body, a private-sector business of any kind, or one of the named critical-infrastructure, essential-service, digital-service, data-centre, or cloud-platform categories.