Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, personal data breach notification
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- Notify the CNPD of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to put individuals' rights, freedoms and guarantees at risk, and state the reasons for the delay if you notify later (Article 27(1) and (2)).NIST Privacy FrameworkCM.AW-P7
- Make the notification to the CNPD describe the nature of the breach, including where possible the categories and approximate number of data subjects affected, its likely consequences and the measures you have taken or propose, and keep it confidential (Article 27(3)).NIST Privacy FrameworkCM.AW-P7
- Document every personal data breach, with its facts, its effects and the remedial measures taken, so that the CNPD can verify your compliance (Article 27(5)).NIST Privacy FrameworkPR.PO-P7
- If you are a processor, notify the controller without undue delay of any personal data breach you become aware of (Article 27(6)).NIST Privacy FrameworkCM.AW-P7
- Communicate a personal data breach likely to result in a high risk to a data subject's rights, freedoms and guarantees to that data subject without undue delay, in clear and plain language, describing its nature, likely consequences and the measures taken or proposed, unless you applied appropriate protection measures to the affected data, have taken later measures that make the high risk no longer likely, or the effort would be disproportionate, in which case inform data subjects by an equally effective means such as a public communication (Article 28).NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 27(1) requires the controller to notify a personal data breach to the CNPD within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights, freedoms and guarantees of individuals. Where the notification cannot be made within 72 hours, Article 27(2) requires the controller to state the reasons for the delay.
Under Article 27(3) the notification is confidential and must at least describe the nature of the breach, its likely consequences and the measures the controller has taken or proposes. Article 27(5) requires the controller to document every personal data breach, with its facts, effects and remedial measures, so that the CNPD can verify compliance. Article 27(6) requires a processor to notify the controller of any personal data breach it becomes aware of, without undue delay.
Article 28(1) requires the controller to communicate to the data subject, without undue delay, a breach likely to result in a high risk to the data subject's rights, freedoms and guarantees. Article 28(2) requires that communication to describe the nature of the breach in clear and plain language and to include the likely consequences and the measures taken or proposed.
Article 28(3) dispenses the communication where appropriate protection measures were applied to the affected data, where later measures make the high risk no longer likely, or where it would involve disproportionate effort, in which case the controller must inform data subjects by an equally effective means such as a public communication.
Article 28(4) lets the CNPD, where the controller has not communicated the breach and the CNPD considers the risk high, require the controller to do so or dispense it on those grounds. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach or processes biometric data.