Reuses other publishers' content, in Mozambique

Lei n.º 13/2026, arts. 47 a 50 · Read the law's page

• Adopt a written information-security policy, a cyber-risk-management methodology, incident-notification procedures, mechanisms to prevent, correct, or mitigate cyber risk, a backup and recovery infrastructure, internal security-audit and oversight mechanisms, and a staff security-awareness and training programme.
• Name a person responsible for information security and stand up a team dedicated to detecting and responding to security incidents.
• If you are part of the Public Administration or the Private Sector at large, rather than one of the specifically named operator categories, also name an internal cybersecurity auditor, adopt an institutional information-security policy, and establish an institutional CSIRT.
• It reaches you regardless of sector or size: Article 2 covers the whole private sector and the public administration alongside named categories of infrastructure, service, and platform operator, and Article 48(2) makes the minimum security requirements below compulsory for every entity the Law covers. Article 2(2) excepts a public-administration body's actions on networks and systems for national defence, internal security, and state security, and on systems that process classified information.

Lei n.º 13/2026, arts. 57 a 66 · Read the law's page

• Notify a cybersecurity incident with a significant impact (a substantial impact, if you are an intermediary provider, a data-centre operator, or a cloud-computing-platform operator), judged by the number of users affected, duration, geographic spread, service disruption, and economic or social impact, within a deadline the National Cybersecurity Authority sets rather than the Law itself: to your sectoral CSIRT and the National CSIRT or, if you are an intermediary digital-service provider, a data-centre operator, or a cloud-computing-platform operator, to the National Cybersecurity Authority. File a monthly report on your response and resolution.
• If you operate a data centre or a cloud-computing platform, also notify your own subscribers promptly of an incident, including a data leak, that affects or may affect their content, and notify the National CSIRT of any incident or data leak you know of (in good time for a data centre, immediately for a cloud platform).
• If you operate a data centre or a cloud-computing platform, also adopt internal rules and policies for business continuity, disaster recovery, and risk management, and give your subscribers a summary of them (articles 63(1)(d) and 64(1)(d)).
• If you disclose a security vulnerability in good faith, including by giving at least 90 calendar days' notice before publishing it, the Law shields you from liability for having done so.
• It reaches you whether you are a Public Administration body, a private-sector business of any kind, or one of the named critical-infrastructure, essential-service, digital-service, data-centre, or cloud-platform categories.

Lei n.º 9/2022, de 29 de Junho (Direitos do Autor e Direitos Conexos), art. 7 · Read the law's page

• You need not obtain permission to reproduce news of the day and reports of events of a merely informational character, or mere facts and data: article 7(1) excludes them from copyright protection.
• Official legislative, administrative and judicial texts and their official translations are likewise unprotected (art. 7(1)).
• You need not obtain permission to use a title that is a generic, necessary or usual designation of the theme or object of a work of a given genre, or that consists exclusively of the names of historical or mythological characters or of living public figures (art. 7(1)).