Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, data protection by design and by default
Lei n.º 133/V/2001 de 22 de Janeiro, art. 26 as republished by Lei n.º 121/IX/2021, de 17 de Março (proteção de dados desde a conceção e por defeito)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Governance
As of .
What it requires
- Apply appropriate technical and organizational measures, such as pseudonymization, both when you determine the means of processing and when you process personal data, so that the data protection principles such as minimization are implemented effectively and the processing protects data subjects' rights (Article 26(1)).
- Apply measures that ensure, by default, that you process only the personal data necessary for each specific purpose, as to the amount collected, the extent of processing, the storage period and accessibility (Article 26(2)).
- Ensure by default that personal data are not made available without human intervention to an indefinite number of individuals (Article 26(2)).
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 26(1) requires the controller, taking account of the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing and its risks to individuals, to apply appropriate technical and organizational measures, such as pseudonymization, both when it determines the means of processing and when it processes, so as to implement the data protection principles effectively.
Article 26(2) requires the controller to apply measures ensuring that, by default, only the personal data necessary for each specific purpose are processed, as to the amount collected, the extent of processing, the storage period and accessibility. Article 26(2) also requires those measures to ensure that, by default, personal data are not made available without human intervention to an indefinite number of individuals. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach or generates content with AI.