Cabo VerdeLaw No. 133/V/2001 on the Protection of Personal Data, data quality principles and processor contracts
Lei n.º 133/V/2001 de 22 de Janeiro, arts. 6 and 24 (nos. 4 to 6) as amended by Lei n.º 121/IX/2021, de 17 de Março (qualidade dos dados e subcontratação)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Governance, Security
As of .
What it requires
- Process personal data lawfully, transparently and in good faith, collect it only for determined, explicit and legitimate purposes, keep it adequate, relevant and limited to the minimum necessary, keep it accurate and up to date, and do not keep it identifiable for longer than the purposes require.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P1
- Bind a processor by a contract or other legal act under which it acts only on your instructions and that sets out the subject matter and duration of the processing, its nature and purpose, the categories of personal data and the controller's obligations and rights, and do not let it engage another processor without your prior specific written authorization (Article 24(4) and (6)).NIST Privacy FrameworkID.DE-P3
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 6 requires personal data to be processed lawfully, transparently and in good faith, collected for determined, explicit and legitimate purposes, kept adequate, relevant and limited to the minimum necessary for those purposes, kept accurate and up to date, and kept identifiable for no longer than those purposes require, with the CNPD able to authorize further processing and longer retention for public-interest archiving, scientific or historical research or statistical purposes where the controller has a legitimate interest, the data subject's rights do not prevail and adequate safeguards apply.
Article 24(4) requires processing carried out by a processor to be governed by a contract or other legal act that binds the processor to the controller and provides, among other things, that the processor acts only on the controller's instructions and sets out the subject matter and duration of the processing, its nature and purpose, the categories of personal data and the controller's obligations and rights.
Article 24(6) bars a processor from engaging another processor unless the controller has first given specific authorization in writing. Lei n.º 121/IX/2021 amended Articles 6 and 15 of Law No. 133/V/2001. Lei n.º 121/IX/2021 entered into force thirty days after its own publication on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.