LexLint.ioBeta

Know the law your code answers to.

Law / Angola

Lei de Protecção das Redes e Sistemas Informáticos, Security Duties for Information-Society Systems, Computer Programs and Databases

Lei n.º 7/17, Artigos 12.º, 13.º, 14.º, 17.º, 18.º e 19.º

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security

What it requires

  • This binds a provider, operator or service provider of an information-society system under Lei n.º 7/17, a class Article 4(ff) defines as broadly as any service normally provided at a distance, by electronic means, at the individual request of a recipient, so the duty reaches far more than social platforms.
  • Guarantee the security of any device or set of devices, and the network supporting communication between them, that stores, processes, retrieves, receives or transmits data in execution of a computer program (Article 12).NIST CSF 2.0PR.IR-01
  • Where you are responsible for managing, operating or providing services for a computer infrastructure, apply the measures and techniques needed to secure and protect the assets essential to that infrastructure's proper functioning (Article 13).NIST CSF 2.0PR.IR-01
  • Where you operate or provide an internet service, promote user registration and carry out the measures and instruments needed to anticipate, detect, react to and recover from security risk situations on your networks (Article 14).NIST CSF 2.0DE.CM-01NIST CSF 2.0ID.IM-04
  • Apply this Law's security measures and techniques to any computer program you make available; the text states no separate support period, update or vulnerability-disclosure-channel duty for the program itself (Article 18).NIST CSF 2.0PR.PS-06
  • Where you use a database, follow technical rules and specialised procedures adequate to protect its access, storage, file duplication, treatment and the recovery of automated information (Article 19).NIST CSF 2.0PR.DS-01NIST CSF 2.0PR.DS-11

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
  • PR.DS-P5Protections against data leaks are implemented.
NIST CSF 2.0
  • ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
  • PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
  • PR.DS-11Backups of data are created, protected, maintained, and tested
  • PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
  • PR.IR-01Networks and environments are protected from unauthorized logical access and usage
  • DE.CM-01Networks and network services are monitored to find potentially adverse events
CIS Controls
  • 3.10Encryption of sensitive data as it crosses networks.
  • 3.11Encryption of sensitive data where it is stored on servers and applications.
  • 6.8Access rights defined by job role, and kept up to date.
  • 7.1A documented, reviewed approach to finding and handling weaknesses.
FINOS AIGF
1 more
ENISA NIS2 guidance
  • 2.1Risk management framework
  • 3.1Incident handling policy
  • 4.1Business continuity and disaster recovery plan
  • 6.2Secure development life cycle
  • 6.5Security testing
  • 6.10Vulnerability handling and disclosure
2 more
  • 9.1Cryptography
  • 11.2Management of access rights

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Article 42 makes a violation of Articles 12, 13, 14 or 18 a contravenção (an administrative infraction) rather than a crime; Article 42(7) states that where the same fact is simultaneously a crime and a contravenção, the agent is always punished as a crime instead, so the contravenção itself carries no criminal exposure.

Penalty structure

Article 42(1)(a) sets this range (Kz 7,000,000 to Kz 150,000,000) for non-compliance with the requirements of Articles 12, 13, 14 or 18; Article 42(1)(b) sets the identical range for non-compliance with Article 17 or 19. Article 42(3) doubles this range for a legal person only where the violation falls under Article 42(2), which does not include these articles, so no doubling applies here.

Rule
Fixed only
As of
Minimum
7,000,000
Currency
AOA
Fixed cap
150,000,000

Who enforces it

Enforcement body

Agência de Protecção de Dados Pessoais (the Personal Data Protection Agency), which investigates the contravenção proceedings under this Law, with fines applied by the Agency's President following the Agency's own deliberation (Article 43).

Settledness

As of
Open questions
Does Article 2's extraterritorial reach in paragraph 2 bind a foreign legal person with no domicile in Angola whose information-society service targets Angolan cyberspace, given paragraph 2(a) requires a legal person's domicile in Angola and paragraph 2(d) names only a foreign citizen, not a foreign legal person, with no residence requirement?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 12 requires the body responsible for promoting the information society, and every provider, operator and service provider of information-society-system services, to guarantee the security of any device or set of devices, and the network supporting communication between them, that stores, processes, retrieves, receives or transmits data in execution of a computer program.

Article 13 requires the entity responsible for management, or the operators and service providers, of a computer infrastructure to apply the measures and techniques needed to secure and protect the assets essential to that infrastructure's proper functioning. Article 14 requires an internet operator or service provider to promote user registration and to carry out the measures and instruments needed to anticipate, detect, react to and recover from security risk situations on its networks.

Article 18 extends this Law's measures and techniques to computer programs, without stating a separate support-period, update or vulnerability-disclosure-channel duty for the program itself, and Article 19 requires database use to follow technical rules and specialised procedures adequate to protect access, storage, file duplication, treatment and the recovery of automated information.

Article 4(ff) defines the bound information-society-service class as broadly as the EU's information-society-service concept: any service normally provided at a distance, by electronic means, at the individual request of a recipient, excluding television and radio broadcasting, automatic note or ticket dispensing, and payment-gated road, parking or similar access even where an electronic device controls or verifies the payment.

Article 47 has the Law enter into force on the date of its publication, the Official Gazette's Diário da República Iª Série n.º 27 of , following approval by the National Assembly on and promulgation by the President on .

When LexLint raises it

When your app profile says your app operates a social platform.

Back to the example  ·  Lint your app

Page updated .