Sao Tome and PrincipeLei n.º 03/2016, Protecção de Dados Pessoais
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www.nadpa-rapdp.org/sites/default/files/2020-11/Law_3_2016_protection_of_personal_data.pdfIn force.
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Licensing, Security, Governance
- Audit expectation
- none
What it requires
- Obtain the data holder's unequivocal authorization before processing their personal data, or rely on one of the Law's specific grounds: performing a contract with them, a legal obligation you face, protecting their vital interests, a public-interest mission, or your own legitimate interest weighed against their rights.NIST Privacy FrameworkCT.PO-P1
- Notify the National Agency for the Protection of Personal Data (NAPPD) in writing at least eight days before starting a wholly or partly automated processing operation.NIST Privacy FrameworkGV.PO-P5
- Obtain NAPPD's prior authorization before processing credit or solvency data, interconnecting personal-data files, or using collected data for a purpose other than the one it was collected for.NIST Privacy FrameworkGV.PO-P5
- If you are not established in Sao Tome and Principe but use means located there to process personal data, designate a representative established in the country and notify NAPPD of that designation.NIST Privacy FrameworkGV.PO-P5
- Process personal data lawfully and in good faith, collect it only for specified, explicit and legitimate purposes tied to your activity, keep it adequate, relevant and not excessive, accurate and updated, and retain it in identifiable form no longer than the collection purpose requires.NIST Privacy FrameworkGV.PO-P1
- Implement appropriate technical and organizational measures against accidental or unlawful destruction, loss, unauthorized alteration, disclosure or access to personal data, choose a subcontractor offering sufficient guarantees, bind it by contract to your instructions and the same measures, and record that contract in a document with legally recognized probative value.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkID.DE-P3
- Do not process personal data you access as a subcontractor, or on the controller's authority, beyond the controller's instructions except under a legal obligation, and keep confidential any personal data you learn of in the course of your duties, including after those duties end.NIST Privacy FrameworkGV.PO-P1NIST Privacy FrameworkPR.PO-P9
- Obtain NAPPD's authorization before interconnecting personal data unless a legal or organic provision already authorizes it, and include in any notification or authorization request to NAPPD your identity, the processing's purposes, the categories of data and data holders, the recipients, the retention period, how holders can access or correct their data, any planned interconnection or transfer abroad, and a description of your security measures.NIST Privacy FrameworkGV.PO-P5
- Where your processing is exempt from notification, still give any person who asks your identity, the processing's purposes, and the data holder's rights of access and rectification.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).
1 more
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 15(4) requires the evidence of the data-protection contract or legal act with a subcontractor, and the requirements for the Article 15(1) security measures, to be recorded in a document with probative value. It names no log of processing events, so the log contents are left empty. Registration particulars sent to the National Agency (Articles 21 to 25) are a filing with the authority, and the public register of Article 25 is the Agency's own register, so neither is a record the controller keeps. The retention period listed among the Article 23 particulars and the storage-limitation rule of Article 5(1)(e) limit the personal data, not a log. Article 3(2)(d) reaches a controller that uses means located in the country; a scope prong that turns on where equipment sits carries no hook value and is left out.
- Kind
- Implicit
- As of
- Provision
- Article 15(4) (evidence of the data-protection contract and the security requirements recorded in a document with probative value)
- Trigger
- personal_data_processing
What this law does
Article 3 applies the Law to processing personal data by automated means, wholly or partly, and to non-automated processing of data held in or intended for a manual file, reaching a controller established in Sao Tome and Principe, one whose activities are carried out there, one whose processing falls under São Toméan law by public or private international law, or one using means located in the country, in which case it must designate a representative there and notify NAPPD of that designation; it also reaches video surveillance and other capture of sound or image that identifies a person, and it exempts only a private individual's exclusively personal or domestic activity that is not meant for systematic communication or diffusion.
Article 5 requires personal data to be treated lawfully and in good faith, collected for specified, explicit and legitimate purposes tied to the controller's activity, kept adequate, relevant, not excessive, accurate and updated, and preserved in identifiable form no longer than those purposes need.
Article 6 permits processing only with the holder's unequivocal authorization or on one of the Law's specific grounds: contract performance, a legal obligation, the holder's vital interests, a public-interest mission, or the controller's own legitimate interest weighed against the holder's rights.
Article 9 subjects interconnecting personal data to NAPPD's authorization unless a legal or organic provision already authorizes it, and requires it to serve a legitimate purpose, avoid a discriminatory effect, and carry appropriate security measures.
Article 15 requires appropriate technical and organizational measures against accidental or unlawful destruction, loss, unauthorized alteration, disclosure or access, a subcontractor chosen for sufficient guarantees and bound by contract to the controller's instructions and the same measures, and that contract recorded in a document with legally recognized probative value; Article 17 bars a subcontractor or anyone else with access to personal data from processing it beyond the controller's instructions except under a legal obligation, and Article 18 binds anyone who learns personal data in the course of their duties to professional secrecy, including after those duties end.
Article 21 requires the controller or its representative to notify NAPPD in writing at least eight days before starting a wholly or partly automated processing operation, and Article 22 requires NAPPD's prior authorization before processing credit or solvency data, interconnecting personal-data files, or using collected data for a purpose other than the one it was collected for.
Articles 23 and 24 fix what a notification or authorization request, and any NAPPD record of it, must state, including the controller's identity, the processing's purposes, the categories of data and recipients, the retention period, how a holder can access or correct their data, any planned interconnection or transfer abroad, and a description of the security measures applied.
Article 25 registers non-exempt processing with NAPPD for public consultation and requires a controller exempt from notification to give any person who asks, at minimum, its identity, the processing's purposes, and the holder's rights of access and rectification. Article 47 defers the Law's own entry into force to general law without stating a day.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .