Sao Tome and PrincipeLei n.º 03/2016, enforcement, offenses and the NAPPD
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www.nadpa-rapdp.org/sites/default/files/2020-11/Law_3_2016_protection_of_personal_data.pdfIn force.
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- National Agency for the Protection of Personal Data (NAPPD), commonly cited as the ANPDP
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect a person who suffered damage from your unlawful processing, or from any other act breaching this Law, to have the right to obtain compensation from you, unless you can prove the act causing the damage is not attributable to you.
- Expect a data holder to be able to complain to NAPPD, and to pursue administrative or judicial recourse, including appeal to the Court of last instance, for a violation of the rights this Law guarantees.
- Expect an administrative fine reaching 1,000,000,000 Dobras, doubled for a violation involving data subject to prior checking under Article 22, for negligently failing to notify NAPPD of processing, giving false information, notifying in breach of Article 23, or maintaining access to open data transmission networks for controllers that do not comply with this Law after NAPPD gives notice, and a separate, lower fine for breaching another provision of this Law.
- Expect negligence to be punishable in the administrative offenses of Article 31, an attempt to be punishable in the administrative offenses that Article 34(2) refers to in Articles 32 and 33, and an attempt to be punishable in each of the crimes in this Law.
- Expect an accessory penalty, such as a temporary or permanent ban on processing, publication of the conviction, or NAPPD's public warning or censure, in addition to any fine or criminal penalty NAPPD or a court imposes.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Arts. 36-41 punish, among other things, omitting the required NAPPD notification or authorization request, providing false information in one, diverting personal data from its collection purpose, illegal interconnection of personal data, unauthorized access to personal data, and breach of professional secrecy, each with imprisonment of up to one or two years or a fine of up to 120 or 150 days depending on the offense; penalties double where the data involved falls under arts. 7 or 8 (sensitive categories or criminal-suspect records), or where unauthorized access was achieved by defeating a technical security measure.
Penalty structure
Art. 31 sets administrative fines, for negligently failing to notify NAPPD of processing, giving false information or notifying in breach of Art. 23, of 50,000,000 to 120,000,000 Dobras for a natural person, 100,000,000 to 200,000,000 for a group of persons without legal personality, and 250,000,000 to 500,000,000 for a legal person, doubled where the violation concerns data subject to Art. 22 prior checking (sensitive data, credit data, interconnection, or repurposing), giving a true ceiling of 1,000,000,000. Art. 32 sets separate, lower administrative fines for other omissions: 25,000,000 to 50,000,000 for breach of arts. 5, 10-13, 16-17 or 25(3), and 45,000,000 to 90,000,000 for breach of arts. 6-9, 19 or 20. The amounts are stated in the Law's own 2016 text in Dobras (the pre-2018 redenomination currency, ISO code STD); the text carries no restatement of them in the redenominated New Dobra (STN).
- Rule
- Fixed only
- As of
- Currency
- STD
- Fixed cap
- 1,000,000,000
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 14 and 27 to 44 set compensation, complaint and appeal routes, administrative fines, crimes and accessory penalties, and the status of the National Agency. They require no log or record of a controller. The one power over a controller's material is Article 39(2)(a), which makes it a crime to refuse, after notice, the collaboration the Agency specifically requests; the Agency may therefore ask for information whenever it chooses, and no record, auditor, report or retention figure is named. The cited articles contain no territorial scope clause.
- Kind
- None
- As of
What this law does
Article 14 gives a person who suffered damage from unlawful processing, or from any other act breaching this Law or its regulations, the right to compensation from the controller, who is exonerated only by proving the damaging act is not attributable to it.
Article 27 preserves a data holder's right to complain to NAPPD alongside administrative or judicial recourse for a violation of this Law, and Article 28 makes a court decision on that violation appealable, on an urgent, breach-only basis, to the Court of last instance.
Articles 31 and 32 set administrative fines for a legal, natural or unincorporated-group violator, up to 1,000,000,000 Dobras, doubled for data subject to Article 22 prior checking, for negligently failing to notify NAPPD of processing under Article 21(1) and (5), giving false information, notifying in breach of Article 23, or, after NAPPD gives notice, maintaining access to open data transmission networks for controllers that do not comply with this Law, and a separate, lower fine of 25,000,000 to 90,000,000 Dobras for breaching another listed provision.
Article 34(1) makes negligence always punishable in the administrative offenses of Article 31, and Article 34(2) makes an attempt always punishable in the administrative offenses it refers to in Articles 32 and 33.
Articles 36 to 40 punish, with imprisonment or a day-fine doubled for Article 7 or 8 data, intentionally omitting a required NAPPD notification or authorization, providing false information in one, diverting or misusing personal data, illegally interconnecting personal data, unauthorized access to personal data, damaging or destroying personal data without authorization, defying a NAPPD order to stop, block or destroy processing, and breaching professional secrecy over personal data.
Article 41 makes an attempt always punishable in these crimes. Article 42 lets NAPPD or a court add an accessory penalty, a temporary or permanent ban on processing, publication of the conviction, or NAPPD's public warning or censure, and Article 43 requires a conviction to be advertised in a widely circulated Portuguese-language periodical and by public notice for at least 30 days.
Article 44 has the National Assembly approve NAPPD's own organic law and the status of its members, guaranteeing their independence, and gives NAPPD its own technical and administrative support. Article 47 defers the Law's own entry into force to general law without stating a day.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .