AngolaLaw on the Protection of Personal Data, sensitive data categories
Lei n.º 22/11, de 17 de Junho de 2011, arts. 13-15 e 17 (dados sensíveis)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Security, Disclosure
- Audit expectation
- none
What it requires
- Do not process sensitive data (philosophical or political convictions, party or union membership, religious faith, private life, racial or ethnic origin, or health and sex life including genetic data) unless a legal provision permits it or the Agência de Protecção de Dados authorises it on one of its listed grounds, such as the data subject's unequivocal, express and written consent.NIST Privacy FrameworkCT.PO-P1
- Notify the Agência de Protecção de Dados of sensitive-data processing carried out under a legal provision, and carry it out with guarantees of non-discrimination and special security measures.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkPR.DS-P5
- Process health and sex-life data, including genetic data, only with the data subject's or their legal representative's unequivocal, express and written consent or the APD's authorisation, unless it is for preventive medicine, medical diagnosis, consented medical care, health-service management, a medical emergency, or the public interest, and only through a health professional bound by professional secrecy.NIST Privacy FrameworkCT.PO-P1
- Process personal data on suspected illicit activities, criminal offences, contraventions, penalties or security measures only as a public authority acting under a legal provision cleared with the APD's prior opinion or under the APD's own authorisation, and limit processing for police investigation to what a specific prevention or prosecution purpose requires.NIST Privacy FrameworkCT.PO-P1
- Post clear notice at any location with a video surveillance or electronic monitoring system that identifies people, stating that image or sound is captured and giving the controller's name, address, phone number and email.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
3 more
- AIR-PREV-020MCP Server Security Governance
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 13 to 15 and 17 condition the processing of sensitive, health, criminal-offence and video surveillance data on a legal provision or an authorization of the Agência de Protecção de Dados, and Article 17(2) requires a notice at surveillance sites. None of them requires a log or record, and the row cites no scope clause. The access trail that Article 31(1)(g) imposes for these data sits in a section this row does not cite.
- Kind
- None
- As of
What this law does
Article 13 subjects the processing of sensitive data, defined as philosophical or political convictions, party or union membership, religious faith, private life, racial or ethnic origin, and health and sex life including genetic data, to a legal provision that permits it or to the APD's authorisation, which the APD may grant only where the data subject or their legal representative has given unequivocal, express and written consent, a nonprofit political, philosophical, religious or trade union body processes only its own members' or regular contacts' data with their consent, the data subject was physically or legally unable to consent and processing protects vital interests, the data subject has manifestly made the data public, the processing serves the establishment, exercise or defence of a right in judicial proceedings, or the processing is indispensable to a public authority's legal or statutory functions including judicial, police or administrative investigation.
Article 13 further requires sensitive data processed under a legal provision to be notified to the APD and carried out with guarantees of non-discrimination and special security measures.
Article 14 permits processing of health and sex-life data, including genetic data, only with the data subject's or their legal representative's unequivocal, express and written consent or the APD's authorisation, unless the processing serves preventive medicine, medical diagnosis, consented medical care, health-service management or statistics, a medical emergency, or the public interest, and only through a health professional bound by professional secrecy.
Article 15 permits processing of data on persons suspected of illicit activities, criminal offences, contraventions, and applicable penalties, security measures, fines or accessory sanctions only by a public authority, under a legal provision cleared with the APD's prior opinion or under the APD's own authorisation, and limits processing for police investigation purposes to what a determined offence's prevention or repression requires.
Article 17 subjects the installation of video surveillance systems and other means of capturing, processing and disseminating sound and images that permit identifying people, including electronic road surveillance systems, to Article 13's regime, and requires the controller to post notice at any location carrying such a system of its existence, of the capture of sound and image, and of the controller's name, address, phone number and email.
When LexLint raises it
When your app profile says your app processes voice recordings, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .