Provides telecom services, in Mozambique

Lei n.º 13/2026, arts. 57 a 66 · Read the law's page

• Notify a cybersecurity incident with a significant impact (a substantial impact, if you are an intermediary provider, a data-centre operator, or a cloud-computing-platform operator), judged by the number of users affected, duration, geographic spread, service disruption, and economic or social impact, within a deadline the National Cybersecurity Authority sets rather than the Law itself: to your sectoral CSIRT and the National CSIRT or, if you are an intermediary digital-service provider, a data-centre operator, or a cloud-computing-platform operator, to the National Cybersecurity Authority. File a monthly report on your response and resolution.
• If you operate a data centre or a cloud-computing platform, also notify your own subscribers promptly of an incident, including a data leak, that affects or may affect their content, and notify the National CSIRT of any incident or data leak you know of (in good time for a data centre, immediately for a cloud platform).
• If you operate a data centre or a cloud-computing platform, also adopt internal rules and policies for business continuity, disaster recovery, and risk management, and give your subscribers a summary of them (articles 63(1)(d) and 64(1)(d)).
• If you disclose a security vulnerability in good faith, including by giving at least 90 calendar days' notice before publishing it, the Law shields you from liability for having done so.
• It reaches you whether you are a Public Administration body, a private-sector business of any kind, or one of the named critical-infrastructure, essential-service, digital-service, data-centre, or cloud-platform categories.