MozambiqueElectronic Transactions Law, Protection of Personal Electronic Data
Lei n.º 3/2017, de 9 de Janeiro, arts. 63(1)-(2), (5), 64, 65(1), (3) (dever de protecção de dados)
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Disclosure, Security, Access restriction, Governance
- Audit expectation
- none
What it requires
- Keep any personal data you collect, process, or disclose electronically accurate, complete, and up to date.NIST Privacy FrameworkCT.PO-P2
- Specify the purpose for collecting personal data and your identity as the processor before collecting it, and limit any later use to that stated purpose.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkGV.PO-P1
- Protect personal data against risk, loss, unauthorised access, destruction, unauthorised use, modification, or disclosure.NIST Privacy FrameworkPR.DS-P5
- Do not access another party's personal data in a computerised archive, file, record, or database, and do not transfer personal data between information systems belonging to distinct services or institutions, without a legal instrument or judicial decision authorising it.NIST Privacy FrameworkCT.PO-P2
- Designate one or more individuals responsible for compliance with this chapter's data protection principles.NIST Privacy FrameworkGV.PO-P3
- Remain responsible for personal data in your possession or custody, including data you transferred to a third party for processing.NIST Privacy FrameworkGV.PO-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P4Privacy roles and responsibilities are coordinated and aligned with third-party stakeholders (e.g., service providers, customers, partners).
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 63 to 65 oblige the data processor to keep personal data accurate and up to date, to state the purpose before collecting, to protect the data against loss and unauthorized access, to prohibit access to or transfer between files without a legal instrument or court decision (article 64), to designate a person responsible, and to remain responsible for data passed to a third party. None of them requires a log, a register or any record, and none names an audit. English of the pinned clause: the data processor must protect personal data against risks, losses, unauthorized access, destruction, use, modification or disclosure. The cited articles carry no scope clause, so there is no territorial hook. The text pinned is the Boletim da República, I Series, number 5 of , through an archive capture, because the row's own host is a compliance vendor.
- Kind
- None
- As of
What this law does
Article 2 applies the Law to natural and legal persons, public or private, that apply information and communication technologies in their activities, including electronic or commercial transactions and electronic government. Article 63(1) requires any data controller who electronically collects, processes, or discloses personal data to keep it accurate, complete, and up to date.
Article 63(2) requires the objectives for which personal data are collected and the data processor's identity to be specified before collection, and limits later use to those stated objectives. Article 63(5) requires the data processor to protect personal data against risk, loss, unauthorised access, destruction, use, modification, or disclosure.
Article 63(7) applies this chapter without prejudice to the article 40 rules on electronic advertising and marketing and to any specific legislation on electronic data protection, and article 63(8) exempts electronic collection, processing, or disclosure of personal data for journalism, artistic or literary expression, or when decided by the competent authorities to safeguard public security and national defence.
Article 64 bars accessing computerised archives, files, records, or databases to learn a third party's personal data, and bars transferring personal data between information systems belonging to distinct services or institutions, except where established by legal instrument or judicial decision. Article 65(1) requires the data processor to designate one or more individuals responsible for compliance with this chapter's principles.
Article 65(3) makes the data processor responsible for personal information in its possession or custody, including information transferred to a third party for processing, subject to the same article 40, journalism, artistic-expression, and public-security exemptions as article 63. Article 75 brings the Law into force 90 days after its publication. The Law appears in the Boletim da República, I Série, n.º 5, as Lei n.º 3/2017 de 9 de Janeiro.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .