AngolaLaw on the Protection of Personal Data
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Disclosure, Security, Licensing
- Audit expectation
- none
What it requires
- Obtain the data subject's unequivocal, express consent before processing their personal data, or notify the Agência de Protecção de Dados, unless a contract-performance, legal-obligation, vital-interest, public-interest, or legitimate-interest ground applies.NIST Privacy FrameworkCT.PO-P1
- Obtain the data subject's consent or the APD's authorisation before processing personal data on their creditworthiness or solvency, unless the information comes from a publicly accessible source, and notify the data subject within sixty days of entering their data in a debtor file.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
- Notify the Agência de Protecção de Dados, or obtain the recipient's express consent, before sending postal or electronic marketing messages or recording a call for commercial purposes, and let the recipient object to further messages free of charge at any time.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Treat a recipient who processes communicated personal data for its own purposes as a controller in its own right, and one who processes it on your behalf and under your instructions as a subcontractor bound by a written contract, and obtain the APD's authorisation before interconnecting personal data held in different files unless a legal provision already permits it.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkGV.PO-P5
- Implement technical and organisational measures adequate to the risk presented by the processing and the nature of the data, and keep a document describing the security measures, standards and procedures applied.NIST Privacy FrameworkPR.DS-P5
- Keep personal data confidential, both as a data controller and as anyone who learns of it in the course of their duties, including after the relationship ends.NIST Privacy FrameworkPR.PO-P9
- Notify the Agência de Protecção de Dados before processing personal data, or obtain its authorisation where notification is not enough, and give it the particulars the law requires about the processing.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).
1 more
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
2 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 31(1)(g) requires the controller of the data named in Articles 13 to 17 and 20 (sensitive data, health and sex-life data, criminal-offence data, credit data, video surveillance and call recording) to be able to verify afterwards which personal data were entered, when and by whom, within a period set by sector rules; that is an access and entry trail. It sets no figure for the period, so no retention value is stated here. Articles 18(3) and 19(5) separately require a promoter of postal or electronic advertising to keep a list of the people who objected, and Article 20(1)(a) starts a call recording with the consent; the Article 31 trail is the main duty here. Articles 35 to 38 make the controller notify or seek authorization from the Agência de Protecção de Dados, which keeps a register open to the public; that register is the authority's, not a log the controller keeps, so no access party is listed for it. No audit of the trail is named in the sections the row cites.
- Kind
- Explicit
- As of
- Provision
- Article 31(1)(g)
- Trigger
- personal_data_processing
What this law does
Article 3 subjects to the law any processing of personal data by any person or entity in the public, private, or cooperative sector, including a controller not established in Angola who uses means located there.
Article 12 requires the data subject's unequivocal, express consent before most processing, or notification to the APD, unless the processing falls under one of Article 12's enumerated exceptions such as contract performance, a legal obligation, vital interests, a public interest mission, or the controller's legitimate interest.
Article 16 conditions processing of credit and solvency data on the data subject's consent or the APD's authorisation unless the information comes from a publicly accessible source, and requires the data subject to be notified within sixty days once their data enters a debtor file.
Articles 18 to 20 require notification to the APD, or the recipient's consent, before sending postal or electronic marketing messages or recording a call for commercial purposes, and require the sender to let the recipient object to further messages at any time free of charge.
Articles 21 to 24 allocate responsibility for communicated data between the discloser, a fellow controller, a subcontractor acting on the discloser's behalf and instructions, or a third party, and require the APD's authorisation for interconnecting personal data held in different files unless a legal provision already permits it.
Article 30 requires technical and organisational measures adequate to the risks presented by the processing and the nature of the data, documented in a security procedures record, and Article 32 binds a data controller and anyone who learns of the data in the course of their duties to professional secrecy, including after those duties end.
Articles 35 to 38 require notification to the APD, or its authorisation where notification is not enough, before processing personal data, fix the particulars a notification or authorisation request must contain, and require processing subject to authorisation or notification to appear in a public APD register.
Articles 39 to 43 apply this law to the public sector subject to further rules on creating, modifying and eliminating files and on inter-agency data sharing, and to the private and cooperative sectors subject to further legislation for specific activities.
Article 67 enters the law into force on the date of its publication, the Official Gazette's Diário da República Iª Série n.º 114 of , following approval by the National Assembly on and promulgation by the President on .
When LexLint raises it
When your app profile says your app sends automated outreach, processes personal data or processes voice recordings.
Back to the example · Lint your app
Page updated .