AngolaLaw on the Protection of Personal Data, rights of data subjects
Lei n.º 22/11, de 17 de Junho de 2011, arts. 25-28 (direitos dos titulares dos dados)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Tell a data subject at least your identity and address, the purposes of processing and the file's existence, the recipients or categories of recipients, whether a reply is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, updating, elimination and objection, when you collect their data or, if collected elsewhere, at the latest thirty days after collection.NIST Privacy FrameworkCM.AW-P1
- Publish an easily accessible privacy policy carrying the article 25 disclosures, including that data on an open network may circulate without security guarantees and could be seen or used by unauthorised third parties, wherever data is collected over an open network.NIST Privacy FrameworkCM.AW-P1
- Give a data subject, free of charge, without restriction and without excessive delay, confirmation of whether you process their data, the purposes, categories and recipients, the specific data itself and any available information on its origin, and let them exercise access to health or sex-life data, including genetic data, through a doctor of their choice.NIST Privacy FrameworkCT.DM-P1
- Let a data subject object at any time, on compelling and legitimate grounds tied to their particular situation, to processing carried out under a public-interest or legitimate-interest ground, and exclude their data from that processing once the objection is justified.NIST Privacy FrameworkCT.PO-P3
- Rectify, update or eliminate a data subject's personal data within sixty business days of a request where its processing does not comply with this law, and notify any recipient the data was previously disclosed to of the correction, update or elimination unless that is demonstrably impossible.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 25 to 28 give the data subject rights to information, access, objection, and rectification, updating and erasure, with a sixty-working-day period for the last, and require the controller to tell recipients of a correction. None of them requires a log or record, names an audit or sets a retention period for a record; Article 28(5) keeps or blocks the personal data itself in stated cases, which is not a log.
- Kind
- None
- As of
What this law does
Article 25 requires the controller to give a data subject at least the controller's identity and address, the purposes of processing and the file created for it, the recipients or categories of recipients, whether replying is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access, rectification, updating, elimination and objection, at the time of collection or, where the data came from elsewhere, at the latest thirty days after collection, in language that is clear, precise and objective for a minor or a person with special needs.
Article 25 treats the right to information as fulfilled, for data collected over open networks, by publishing an easily accessible privacy policy carrying that same information together with a warning that personal data may circulate on the network without security guarantees and risk being seen or used by unauthorised third parties.
Article 26 gives a data subject the right to obtain from the controller, freely and without restriction, delay or excessive cost, confirmation of whether their data are processed, the purposes and categories of that processing, the recipients, the specific data itself, and any available information on its origin, and lets a data subject exercise access to health or sex-life data, including genetic data, through a doctor of their choice.
Article 27 lets a data subject object at any time, on compelling and legitimate grounds tied to their particular situation, to processing carried out under Article 12's public-interest or legitimate-interest grounds, obliging the controller to exclude their data from that processing once the objection is justified.
Article 28 requires the controller to rectify, update or eliminate a data subject's personal data within sixty business days of a request where its processing does not comply with this law, and to notify any recipient the data were previously disclosed to of the correction, update or elimination, unless that is demonstrably impossible.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .