AngolaLaw on the Protection of Personal Data, enforcement and supervision
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Agência de Protecção de Dados, a public legal person with administrative, financial and asset autonomy composed of seven members, to supervise compliance with this law, issue guidance, decide complaints, register and publish processing files, and exercise its sanctioning function.
- Register a code of conduct with the APD before relying on it, and expect the APD to reject a code that conflicts with this law or other applicable legislation.NIST Privacy FrameworkGV.PO-P5
- Expect any person to be able to pursue an administrative or judicial remedy for a breach of this law's data protection rules, in addition to filing a complaint with the APD, and expect an APD decision to be appealable to the administrative courts.
- Expect to face judicial liability for reparation of moral or patrimonial harm caused to a person by misuse of their personal data, with the amount set by a judge.
- Expect an administrative fine, in national currency equivalent, of USD 75,000 to USD 150,000 for violating the security, professional secrecy, or special category duties in Articles 14, 15, 16, 17, 20, 30, 31 or 32, or of USD 65,000 to USD 130,000 for violating the general principles in Articles 6 to 11 or the consent, communication, or interconnection duties in Articles 18, 19 and 21 to 24, tripled for a company or association.
- Expect criminal liability of three to eighteen months' imprisonment or a corresponding fine, doubled for sensitive category data, for omitting a required APD authorisation request, giving false information in a notification or authorisation request, carrying out an illegal data interconnection, or failing to comply with the APD's own deadline for a required action.
- Do not access personal data whose access is barred to you without authorisation, on pain of six months' to two years' imprisonment or a corresponding fine, aggravated where achieved by defeating security rules or for a benefit.NIST Privacy FrameworkCT.PO-P1
- Do not erase, destroy, damage, suppress or modify personal data without due authorisation, on pain of eighteen months' to three years' imprisonment or a corresponding fine, aggravated for particularly serious damage.NIST Privacy FrameworkCT.PO-P1
- Interrupt, cease or block processing once the APD has notified you to do so, and cooperate with an APD request, on pain of up to three years' imprisonment or a corresponding fine for qualified disobedience.NIST Privacy FrameworkGV.PO-P5
- Keep personal data confidential once bound by professional secrecy, on pain of imprisonment of up to eighteen months, rising to two years for a public official, a financial gain motive, or harm to the data subject's reputation or privacy.NIST Privacy FrameworkPR.DS-P5
- Expect a court to add, alongside a fine, a temporary or permanent processing ban, an order to block, erase or destroy data, or publication of the conviction at your expense in a widely circulated periodical.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Failing to seek the APD's required authorisation, giving false information in a notification or authorisation request, carrying out an illegal data interconnection, or missing an APD compliance deadline draws imprisonment of three to eighteen months or a corresponding fine, doubled for sensitive category data under Articles 13 to 16 (Article 55). Unauthorised access to personal data whose access is barred to the actor draws imprisonment of six months to two years or a corresponding fine, aggravated for defeating security rules or for a benefit, and prosecuted only on the victim's complaint (Article 56). Erasing, destroying, damaging, suppressing or modifying personal data without authorisation draws imprisonment of eighteen months to three years or a corresponding fine, doubled for particularly serious damage, or up to two years for negligence (Article 57). Failing to interrupt, cease or block processing after APD notice, or otherwise disobeying an APD requirement, draws imprisonment of up to three years or a corresponding fine (Article 58). Violating the duty of professional secrecy over personal data draws imprisonment of up to eighteen months or a corresponding fine, rising to two years for a public official, a financial gain motive, or harm to the data subject's reputation, honour or privacy (Article 59). An attempt of any of these crimes draws imprisonment of up to six months or a corresponding fine (Article 60).
Penalty structure
Administrative fines run from USD 65,000 to USD 130,000 for violating the general principles in Articles 6 to 11, the consent requirement, or the communication and interconnection duties in Articles 18, 19 and 21 to 24, and from USD 75,000 to USD 150,000 for violating the security, professional secrecy, or special category duties in Articles 14 to 17, 20, 30, 31 or 32 (Article 51(1)), tripled to a maximum of USD 450,000 for a company, corporation or unincorporated association (Article 51(2)). Separate criminal penalties in Articles 55 to 60 run up to three years' imprisonment or a corresponding fine, with no separate monetary ceiling stated for the fine beyond the amount corresponding to the prison term.
- Rule
- Fixed only
- As of
- Minimum
- 65,000
- Currency
- USD
- Fixed cap
- 450,000
Who enforces it
Enforcement body
Agência de Protecção de Dados (APD)
Settledness
- As of
- Open questions
- Does a false statement in a notification to the Agência de Protecção de Dados fall under the contravention in Article 51(1)(a)(ii), which covers a notification made "com prestação de falsas informações" ("with the provision of false information"), or under the crime in Article 55(1)(b), which covers "fornecer falsas informações na notificação" ("providing false information in the notification"), given that Article 49 leaves other sanction regimes in force?
- At what exchange rate and on what date is the United States dollar amount in Article 51(1) converted into national currency, given that the Article fixes the fines "em montante equivalente a moeda nacional" ("in an amount equivalent in national currency")?
What it makes you log
Logging duty
Article 44(1)(a) charges the Agência de Protecção de Dados with supervising the application of the law, and Article 58(2)(a) makes it qualified disobedience to refuse without just cause the cooperation the Agency asks for. That is a regulator's power to demand cooperation, not a duty to keep a log or record, so the instrument imposes no record duty and the audit expectation is on request by the regulator. Articles 44(1)(f) and 53(3) have the Agency keep and publish its own register and its decisions; those are the authority's records, not a controller log. The row cites no scope clause.
- Kind
- None
- As of
What this law does
Article 44 establishes the Agência de Protecção de Dados as a public legal person with administrative, financial and asset autonomy, composed of seven members, three designated by the President of the Republic including the Agency's President, three elected by the National Assembly, and one judicial magistrate elected by the Superior Council of Judicial Magistracy, and gives it functions including supervising this law, issuing guidance, deciding complaints, registering and publishing processing files, cooperating internationally, exercising its sanctioning function, and reporting annually to the Executive.
Article 46 lets the APD stimulate, register, and reject codes of conduct that conflict with this law. Article 47 lets any person pursue an administrative or judicial remedy for a breach of this law's rules in addition to a complaint to the APD, and makes an APD decision appealable through administrative litigation. Article 48 entitles a person who suffers moral or patrimonial harm from misuse of their personal data to seek judicial reparation, with the judge setting the harm's value.
Article 51 fines a violation of Articles 14 to 17, 20, 30, 31 or 32 from USD 75,000 to USD 150,000, and a violation of Articles 6 to 11's principles, the consent requirement, or Articles 18, 19 and 21 to 24 from USD 65,000 to USD 130,000, tripling the applicable limits for a company, corporation or unincorporated association, and makes both attempt and negligence punishable.
Article 55 makes omitting a required APD authorisation request, giving false information in a notification or authorisation request, an illegal data interconnection, or missing an APD compliance deadline a crime punishable by three to eighteen months' imprisonment or a corresponding fine, doubled for Article 13 to 16 sensitive data.
Article 56 makes unauthorised access to personal data whose access is barred to the actor a crime punishable by six months to two years' imprisonment or a corresponding fine, aggravated for defeating security rules or for a benefit, and prosecuted only on complaint.
Article 57 makes erasing, destroying, damaging, suppressing or modifying personal data without authorisation a crime punishable by eighteen months to three years' imprisonment or a corresponding fine, doubled for particularly serious damage, or up to two years for negligence. Article 58 makes failing to interrupt, cease or block processing after APD notice, or otherwise disobeying an APD requirement, a crime punishable by up to three years' imprisonment or a corresponding fine.
Article 59 makes violating the duty of professional secrecy over personal data a crime punishable by up to eighteen months' imprisonment or a corresponding fine, rising to two years for a public official, a financial-gain motive, or harm to the data subject's reputation, honour or privacy.
Article 61 lets a court add, alongside a fine, a temporary or permanent processing ban, an order to block, erase or destroy data, or publication of the conviction at the convicted party's expense in a widely circulated periodical.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .