Makes high-risk automated decisions, in Mozambique

Lei n.º 13/2026, arts. 47 a 50 · Read the law's page

• Adopt a written information-security policy, a cyber-risk-management methodology, incident-notification procedures, mechanisms to prevent, correct, or mitigate cyber risk, a backup and recovery infrastructure, internal security-audit and oversight mechanisms, and a staff security-awareness and training programme.
• Name a person responsible for information security and stand up a team dedicated to detecting and responding to security incidents.
• If you are part of the Public Administration or the Private Sector at large, rather than one of the specifically named operator categories, also name an internal cybersecurity auditor, adopt an institutional information-security policy, and establish an institutional CSIRT.
• It reaches you regardless of sector or size: Article 2 covers the whole private sector and the public administration alongside named categories of infrastructure, service, and platform operator, and Article 48(2) makes the minimum security requirements below compulsory for every entity the Law covers. Article 2(2) excepts a public-administration body's actions on networks and systems for national defence, internal security, and state security, and on systems that process classified information.

Lei n.º 13/2026, arts. 57 a 66 · Read the law's page

• Notify a cybersecurity incident with a significant impact (a substantial impact, if you are an intermediary provider, a data-centre operator, or a cloud-computing-platform operator), judged by the number of users affected, duration, geographic spread, service disruption, and economic or social impact, within a deadline the National Cybersecurity Authority sets rather than the Law itself: to your sectoral CSIRT and the National CSIRT or, if you are an intermediary digital-service provider, a data-centre operator, or a cloud-computing-platform operator, to the National Cybersecurity Authority. File a monthly report on your response and resolution.
• If you operate a data centre or a cloud-computing platform, also notify your own subscribers promptly of an incident, including a data leak, that affects or may affect their content, and notify the National CSIRT of any incident or data leak you know of (in good time for a data centre, immediately for a cloud platform).
• If you operate a data centre or a cloud-computing platform, also adopt internal rules and policies for business continuity, disaster recovery, and risk management, and give your subscribers a summary of them (articles 63(1)(d) and 64(1)(d)).
• If you disclose a security vulnerability in good faith, including by giving at least 90 calendar days' notice before publishing it, the Law shields you from liability for having done so.
• It reaches you whether you are a Public Administration body, a private-sector business of any kind, or one of the named critical-infrastructure, essential-service, digital-service, data-centre, or cloud-platform categories.

Proposta de Lei sobre o Regime Jurídico de Proteção de Dados Pessoais, approved by the Council of Ministers (6th Ordinary Session), 3 March 2026; submitted to the Assembly of the Republic