Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures
Lei n.º 133/V/2001 de 22 de Janeiro, arts. 11 (nos. 1 and 3) and 25 as republished by Lei n.º 121/IX/2021, de 17 de Março (registos de infrações e medidas especiais de segurança)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Security
As of .
What it requires
- Create or keep a central register on persons suspected of illegal activities or on criminal or administrative offences, penalties or security measures only as a public service with that legal competence, and limit processing for police investigation to what a concrete danger or a particular offence requires.NIST Privacy FrameworkCT.PO-P1
- Take the additional information security measures Article 25 lists for special-category and criminal-record data, including controlling entry to processing premises, controlling who can read, copy or alter data carriers, controlling use of and access to the processing systems, and logically separating health and sex life data, including genetic data, from other personal data.NIST Privacy FrameworkPR.AC-P4NIST Privacy FrameworkPR.AC-P2
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.AC-P2Physical access to data and devices is managed.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
2 more
- AIR-PREV-020MCP Server Security Governance
- AIR-DET-001AI Data Leakage Prevention and Detection
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 11(1) restricts central registers on persons suspected of illegal activities, criminal and administrative offences, and decisions applying penalties, security measures, fines or additional penalties to public services with that legal competence, observing the procedural and data protection rules set by law. Article 11(3) limits processing for police investigation purposes to what preventing a concrete danger or prosecuting a particular offence requires.
Article 25 requires the controllers of the data referred to in Article 8(1), Article 8(4) and (5) and Article 11(1) to take adequate additional information security measures, including controlling entry to processing premises, controlling who may read, copy or alter data carriers, and controlling use of the automated processing systems and access to the data, and requires systems to separate health and sex life data, including genetic data, logically from other personal data.
The law itself entered into force thirty days after its publication, following approval by the Assembleia Nacional on and enactment by the President on . The Law appears in the Boletim Oficial da República de Cabo Verde, I Série, n.º 2, of .
When LexLint raises it
When your app profile says your app crawls the web, trains models, handles health records or processes biometric data.