Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, data protection impact assessment
Lei n.º 133/V/2001 de 22 de Janeiro, art. 29 as republished by Lei n.º 121/IX/2021, de 17 de Março (avaliação de impacto sobre a proteção de dados)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- DPIA
As of .
What it requires
- Before you start processing, and before you notify it to the CNPD, carry out an impact assessment of the envisaged operations on the protection of personal data if the processing, in particular using new technologies, is likely to result in a high risk to individuals' rights and freedoms (Article 29(1)).NIST Privacy FrameworkID.RA-P4
- Carry out the assessment in particular for a systematic and extensive evaluation of personal aspects of individuals based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; for large-scale processing of the special categories of data in Article 8(1) or of data on criminal convictions and offences in Article 11; and for large-scale systematic monitoring of publicly accessible areas (Article 29(2)).NIST Privacy FrameworkID.RA-P4
- Make the assessment include at least a systematic description of the envisaged processing and its purpose, an assessment of its necessity and proportionality, an assessment of the risks to data subjects' rights and freedoms, and the measures envisaged to address those risks (Article 29(7)).NIST Privacy FrameworkID.RA-P4
- Seek the advice of your data protection officer, if you have designated one, when you carry out the assessment (Article 29(4)).NIST Privacy FrameworkID.RA-P4
- Where necessary, seek the views of data subjects or their representatives on the intended processing, and review whether the processing follows the assessment, at least when the risk changes (Article 29(8) and (9)).NIST Privacy FrameworkCM.AW-P2NIST Privacy FrameworkGV.MT-P1
- Communicate the result of the assessment to the CNPD when you notify the processing (Article 29(10)).NIST Privacy FrameworkID.RA-P4
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.MT-P1Privacy risk is re-evaluated on an ongoing basis and as key factors, including the organization’s business environment (e.g., introduction of new technologies), governance (e.g., legal obligations, risk tolerance), data processing, and systems/products/services change.
- CM.AW-P2Mechanisms for obtaining feedback from individuals (e.g., surveys or focus groups) about data processing and associated privacy risks are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 29(1) requires a controller whose processing, in particular using new technologies, is likely to result in a high risk to individuals' rights and freedoms to carry out, before starting the processing and notifying it to the CNPD, an impact assessment of the envisaged processing operations on the protection of personal data.
Article 29(2) makes an assessment mandatory in particular for a systematic and extensive evaluation of personal aspects of individuals based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based, for large-scale processing of the special categories of data in Article 8(1) or of data on criminal convictions and offences in Article 11, and for large-scale systematic monitoring of publicly accessible areas.
Article 29(4) requires the controller to seek the advice of the data protection officer, where one has been designated, when carrying out the assessment. Article 29(7) requires the assessment to contain at least a systematic description of the envisaged processing and its purpose, an assessment of its necessity and proportionality, an assessment of the risks to data subjects' rights and freedoms, and the measures envisaged to address those risks.
Article 29(8) requires the controller, where necessary, to seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations. Article 29(9) requires the controller, where necessary, to review whether the processing is carried out in accordance with the assessment, at least when the risk represented by the processing operations changes.
Article 29(10) requires the controller, when notifying the processing, to communicate the result of the assessment to the CNPD. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, makes high-risk automated decisions, processes biometric data or handles health records.