MozambiqueData Centre Regulation, security obligations of data centres
Decreto n.º 71/2025, art. 14 (Regulamento de Centros de Dados)
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security
What it requires
- It reaches you if you operate a data centre in Mozambique: Article 2 applies the Regulation to all data-centre operators and data centres active in the national territory, and a data centre already operating when it entered into force has one year from that date to adapt (Article 54).
- Keep the data centre in a secure zone under continuous surveillance, and keep the surveillance record for at least 90 days (Article 14(b)).
- Put restricted access control and access records on the functional spaces, with multi-factor authentication and detailed entry and exit records for the critical areas (Article 14(c)).
- Run an incident-management system with documented response plans for physical incidents, regular drills, and notice of breaches to the regulatory authority and to your users within defined deadlines (Article 14(d)).
- Maintain security measures against current threats and vulnerabilities, physical and logical redundancy for recovery and continuity, fire and intrusion protection, and cyber-security measures including network segmentation (Article 14(e) to (h)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
The Entidade Reguladora de Tecnologias de Informação e Comunicação, the regulatory authority that registers and licenses data centres and, under Article 50(1), supervises their operators.
What this law does
Article 14 of the Data Centre Regulation requires a data centre to sit in a secure zone under continuous surveillance, with the surveillance record kept for at least 90 days. Article 14 requires a data centre to have separate functional spaces under restricted access control with access records. Article 14 requires multi-factor authentication to enter the critical areas of a data centre.
Article 14 requires a data centre to run an incident-management system with documented response plans for physical incidents. Article 14 requires that system to provide for notice of breaches to the regulatory authority and to the data centre's users within defined deadlines. Article 14 requires physical and logical redundancy that guarantees recovery, availability and continuity of the services given to users.
Article 14 requires cyber-security measures, including protection of the internal networks used for control systems and network segmentation to isolate critical devices. Article 51(1) of the Regulation makes a contravention punishable by a fine of 40 to 60 minimum wages for an individual and 90 to 150 minimum wages for a legal person. Among the contraventions Article 51(1) lists, item (i) is a failure to meet the security obligations of Article 14.
Article 54 gives a data centre already operating when the Regulation enters into force one year from that date to adapt to it. The Decree approving the Regulation enters into force 90 days after its publication.
When LexLint raises it
When your app profile says your app provides cloud services.
Back to the example · Lint your app
Page updated .