Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, enforcement and supervision
Lei n.º 133/V/2001 de 22 de Janeiro, as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 37, 45-47, 49-50, 59, 61-63 and 69 (recursos, contraordenações e crimes)
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect data protection supervision to follow up, evaluate and control the activity of the organs and services legally competent to process personal data, in compliance with the Constitution and this law.
- Expect the CNPD to help draft codes of conduct and to declare whether a draft submitted by a professional association or representative organization complies with the data protection laws and regulations in force.
- Expect any person to be able to seek judicial recourse for a violation of the rights this law guarantees, in addition to filing a complaint with the CNPD.
- Expect to be held liable to compensate a person for damage caused by unlawful processing or another act that breaches data protection legislation or regulation, unless you prove that the fact that caused the damage is not attributable to you.
- Expect an administrative fine of CVE 50,000 to 500,000 for an individual or CVE 300,000 to 3,000,000 for a legal person or entity without legal personality for negligently omitting or falsifying the Article 39 notification, doubled for data subject to Article 40 prior authorization, or a fine of CVE 100,000 to 1,000,000, doubled for failing the obligations in Articles 7, 8, 11, 12, 35 or 36, for another listed omission.
- Expect criminal liability of up to one year's imprisonment or a fine of up to 120 days, doubled for Article 8 or 11 data, for intentionally omitting a required CNPD notification or authorization request, giving false information in one, diverting or using data incompatibly with the purpose of collection, or carrying out an illegal data interconnection.
- Do not erase, destroy, damage, suppress or modify personal data without authorization so as to make it unusable or impair its usability, on pain of up to two years' imprisonment or a fine of up to 240 days, doubled for particularly serious damage.NIST Privacy FrameworkCT.PO-P1
- Interrupt, cease or block processing once notified to do so, cooperate with a CNPD request, and erase or destroy personal data once notified or once its retention period under Article 6 has elapsed, on pain of the penalty for qualified disobedience.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkCT.DM-P5
- Keep personal data confidential once bound by professional secrecy, on pain of imprisonment from six months to three years or a fine of eighty to two hundred days, increased by half for a civil servant, a financial gain motive, or endangering another person's reputation, honor or private life.NIST Privacy FrameworkPR.DS-P5
- Expect a temporary or permanent processing ban, an order to block, erase or destroy data, publication of the conviction at your expense in a widely circulated periodical, or a public warning or censure to be ordered alongside a fine or penalty.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Intentional non-compliance with the notification or authorization duties draws up to one year's imprisonment or a fine of up to 120 days, doubled where the data is Article 8 special-category or Article 11 criminal-record data (Article 59); erasure, destruction or modification of personal data without authorization draws up to two years' imprisonment or a fine of up to 240 days, doubled for particularly serious damage (Article 61); qualified disobedience, including failing to cooperate with the CNPD or to erase or destroy personal data after notice or after its retention period has elapsed, draws the corresponding penalty (Article 62); and violation of professional secrecy over personal data draws imprisonment from six months to three years or a fine of 80 to 200 days, increased by half for a civil servant or a financial advantage motive (Article 63). These are day fine terms; the statute does not itself state the escudo value of a day fine unit.
Penalty structure
Administrative offences: negligently omitting the Article 39 notification, or giving false information in it, draws a fine of CVE 50,000 to 500,000 for an individual or CVE 300,000 to 3,000,000 for a legal person or entity without legal personality, and the fine is doubled "para o dobro dos seus limites" for data subject to Article 40 prior authorization, so the ceiling for a legal person is CVE 6,000,000 (Article 49). Other listed omissions draw a fine of CVE 100,000 to 1,000,000, doubled for failures touching Articles 7, 8, 11, 12, 35 or 36 (Article 50). The lowest fine the instrument states is CVE 50,000 and the highest, once doubled, is CVE 6,000,000. Separately, Articles 59 to 67 create day fine and imprisonment crimes for the same and related conduct; see the criminal exposure note.
- Rule
- Fixed only
- As of
- Minimum
- 50,000
- Currency
- CVE
- Fixed cap
- 6,000,000
Who enforces it
Enforcement body
Comissão Nacional de Protecção de Dados (CNPD)
Settledness
- As of
- Open questions
- Does a provider that "mantiverem o acesso às redes abertas de transmissão de dados" to a controller after the CNPD has notified it, the omission Article 49 paragraph 1 fines, include an internet access provider that has no say in how its customer processes personal data?
What it reaches
Obligation class
Governance, Reporting
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- processing of personal data in the context of the activities of an establishment of a controller or a processor, public or private, situated in national territory, whether or not the processing takes place inside the territory (no âmbito das atividades de um estabelecimento de um responsável do tratamento ou de um subcontratante, de natureza pública ou privada, situado em território nacional)
- processing carried out outside national territory, in a place where Cabo Verdean law applies by virtue of international law (fora do território nacional, em local onde a legislação cabo-verdiana seja aplicável por força do direito internacional)
- processing by a controller or processor not established in national territory of the personal data of data subjects in national territory, where the processing relates to the offer of goods or services to them or to the monitoring of their behavior (responsável pelo tratamento ou de um subcontratante que, não estando estabelecido no território nacional, proceda ao tratamento de dados pessoais de titulares dos dados que se encontrem no território nacional)
What it makes you log
Logging duty
Articles 37, 45 to 47, 49, 50, 59, 61 to 63 and 69 set the objectives of supervision, the CNPD's role on codes of conduct, judicial recourse, civil liability, fines, crimes and ancillary sanctions. None requires the controller to keep a log or a record. The audit expectation is the CNPD's power to demand cooperation: Article 62(2)(a) punishes a person who, once notified, refuses without just cause the cooperation the CNPD specifically requires, and the article sets no schedule and names no record. Article 50(1)(a) refers to the representative of Article 2(4) for a controller with immunity, which is not a territorial hook of the Act. The cited sections state no territorial hook.
- Kind
- None
- As of
What this law does
Article 37 has the supervision of personal data protection follow up, evaluate and control the activities of legally competent organs or services processing personal data, safeguarding the Constitution, this Law, and the fundamental rights, freedoms and guarantees of citizens. Article 45 has the CNPD help draft codes of conduct and declare whether a submitted draft complies with the data protection laws and regulations in force.
Article 46 lets any person seek judicial recourse for a violation of the rights this law guarantees, in addition to a complaint to the CNPD, and Article 47 entitles a person who suffers damage from an unlawful processing operation or another act that breaches data protection legislation or regulation to compensation from the controller, who may be exempted in whole or in part on proving that the fact that caused the damage is not attributable to them.
Article 49 fines an entity that negligently fails the Article 39 notification duty, gives false information, or notifies without observing Article 41, CVE 50,000 to CVE 500,000 for an individual or CVE 300,000 to CVE 3,000,000 for a legal person or entity without legal personality, doubled for data subject to Article 40 prior authorization, and Article 50 fines another listed omission, including failing to designate a representative under Article 2(4) or to observe the obligations in Articles 6, 13, 14, 20, 23, 25 and 33 and Article 43(3), from CVE 100,000 to CVE 1,000,000, doubled for a failure to meet the obligations in Articles 7, 8, 11, 12, 35 or 36.
Article 59 makes it a crime, punishable by up to one year's imprisonment or a fine of up to 120 days and doubled for the data referred to in Articles 8 and 11, to intentionally omit a required CNPD notification or authorization request, give false information in one, divert or use personal data incompatibly with the purpose of collection, or promote or carry out an illegal interconnection of personal data, among other listed acts.
Article 61 makes erasing, destroying, damaging, suppressing or modifying personal data without authorization so as to make it unusable or impair its usability a crime punishable by up to two years' imprisonment or a fine of up to 240 days, doubled for particularly serious damage.
Article 62 makes failing to interrupt, cease or block processing after notice, refusing without just cause to cooperate with the CNPD, or failing to erase or destroy personal data after notice or once its retention period under Article 6 has elapsed, punishable as qualified disobedience.
Article 63 makes violating the duty of professional secrecy over personal data a crime punishable by imprisonment from six months to three years or a fine of eighty to two hundred days, increased by half for a civil servant, a financial advantage motive, or endangering another person's reputation, honor or private life.
Article 69 allows a temporary or permanent prohibition of processing, blocking, erasure or destruction of data, publication of the sentence at the convicted party's expense, or a public warning or censure of the controller to be ordered in addition to a fine or penalty. The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on and enactment by the President on . The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of .
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .