LexLint.ioBeta

Know the law your code answers to.

Law / Cabo Verde

Law No. 133/V/2001 on the Protection of Personal Data

Lei n.º 133/V/2001 de 22 de Janeiro (Lei de Protecção de Dados Pessoais), as republished by Lei n.º 121/IX/2021, de 17 de Março, arts. 7, 12, 24 (nos. 1 to 3), 33-34, 39-40, 43 and 71

In force since .

A comprehensive regime rule binding public and private bodies.

Obligation class
Consent, Disclosure, Security, Licensing
Audit expectation
none

What it requires

  • Process personal data only where the data subject has unambiguously consented or where processing is necessary for a contract, a legal obligation, the data subject's vital interests, a public interest task, or your or a third party's legitimate interest that does not override the data subject's rights.NIST Privacy FrameworkCT.PO-P1
  • Obtain the CNPD's authorization, or point to a legal provision establishing the combination, before combining personal data from different filing systems, and ensure any combination is necessary and adequate for its purposes, avoids discrimination, and carries adequate security measures.NIST Privacy FrameworkGV.PO-P5
  • Implement technical and organizational measures adequate to the risks and the nature of the data to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and choose a processor offering sufficient guarantees about those measures.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkID.DE-P2
  • Do not process personal data you access in the course of your duties except on the controller's instructions, unless the law requires otherwise, and keep personal data confidential as a matter of professional secrecy, both during and after your role ends.NIST Privacy FrameworkPR.AC-P4
  • Notify the CNPD before carrying out a wholly or partly automated personal data processing operation, and obtain the CNPD's prior authorization, unless a legal act authorizes it, for processing of the data referred to in points (a) and (c) of Article 8(1) and in Article 11(2), credit and solvency data, interconnection of personal data, or use of personal data for purposes other than those for which it was collected.NIST Privacy FrameworkGV.PO-P5
  • Publish, through the CNPD's public register, or make available to anyone who asks, the particulars of a processing operation not covered by a legal provision.NIST Privacy FrameworkCM.AW-P1

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
  • GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
  • CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
  • PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
  • PR.DS-P5Protections against data leaks are implemented.
NIST CSF 2.0
  • GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
  • PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
FINOS AIGF
2 more

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Articles 7, 12, 24(1) to (3), 33, 34, 39, 40, 43 and 71 set the lawful bases, the CNPD's authorization of interconnection, the security and confidentiality duties, the notification to the CNPD (Article 39) and its prior authorization (Article 40), and the register Article 43 describes. That register is kept by the CNPD and is open to anyone; a controller exempt from notification only has to give any person who asks the particulars Article 42(1) lists. None of the cited sections requires the controller to keep a log or a record of its own. Article 24 names security measures without naming a log; the access and input controls sit in Article 25, which this row does not cite. The cited sections state no territorial hook; Article 2 is not among them.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 7 permits processing only where the data subject has unambiguously consented or where processing is necessary for a contract to which the data subject is party, a legal obligation, the data subject's vital interests where the data subject is physically or legally unable to consent, a public interest task or the exercise of public authority, or the legitimate interest of the controller or of a third party to whom the data is disclosed that does not override the data subject's interests, rights, freedoms and guarantees.

Article 12 subjects the interconnection of personal data, where no legal provision already establishes it, to the authorization of the CNPD, requested by the controller or jointly by the controllers concerned, and requires the interconnection to be necessary and adequate for the controllers' legal or statutory purposes and legitimate interests, to avoid discrimination or any reduction of the data subjects' fundamental rights, freedoms and guarantees, to take account of the type of data interconnected, and to carry adequate security measures.

In the text republished in 2013, Article 10 gave that authorization to the Comissão Parlamentar de Fiscalização. Lei n.º 121/IX/2021 amended the article to name the CNPD.

Article 24 requires the controller to put in place technical and organizational measures appropriate to protect personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, at a level of security suited to the risks of the processing and the nature of the data, and to choose a processor offering sufficient guarantees about those measures.

Article 33 bars anyone acting under the authority of the controller or processor, and the processor itself, from processing personal data they can access except on the controller's instructions, unless legal obligations require otherwise, and Article 34 binds controllers and anyone who learns of the data in the course of their functions to professional secrecy, including after those functions end.

Article 39 requires the controller or its representative to notify the CNPD before carrying out a wholly or partly automated processing operation or set of operations serving one or more related purposes, and Article 40 additionally requires the CNPD's authorization, unless a legal act already authorizes it, for processing of the data referred to in points (a) and (c) of Article 8(1) and in Article 11(2), credit and solvency data, interconnection of personal data under Article 12, and use of personal data for purposes other than those for which it was collected.

Article 43 requires processing that must be authorized or notified, and is not the subject of a legal act, to appear in a CNPD register open to consultation by anyone, and requires a controller exempt from notification to give anyone who asks, in an appropriate manner, at least the particulars listed in Article 42(1).

The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on and enactment by the President on . The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of .

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .