Handles health records, in Sao Tome and Principe

Lei n.º 03/2016, arts. 7-8, 16 (sensitive categories, criminal-offense records and special security measures) · Read the law's page

• Before processing a sensitive category of data (political, religious, trade-union or philosophical affiliation, racial or ethnic origin, private life, health, sex life, or genetic data), obtain the holder's explicit authorization, rely on a specific legal provision, or obtain NAPPD authorization for an important public interest.
• Where you process health or sex-life data, including genetic data, for preventive medicine, diagnosis, care or health-service management, do so only through a health professional or another person bound by professional secrecy, notify NAPPD of the processing, and secure it with appropriate information-security measures.
• Obtain NAPPD's authorization before processing sensitive personal data under the important-public-interest ground.
• Maintain a central record of persons suspected of unlawful activity, a criminal offense or an administrative offense, and of penalties, security measures, fines or ancillary sanctions, only where you are a public service with specific legal competence to do so, and limit any processing for police investigation to what a specific danger or offense requires.
• Put in place the special safety measures the Law requires of a controller that processes sensitive data under Article 7(2) or keeps records of suspected unlawful activity under Article 8: control of premises entry, data-carrier handling, unauthorized disclosure, system access, transmission, and data-entry logging, and keep health and sex-life data logically separated from other personal data.