Mozambique

Decreto n.º 14/2026, de 17 de Abril, issued by the Council of Ministers and published in the Boletim da República, I Série, n.º 72, creates the National Commission for Artificial Intelligence (CNIA) (art. 1). The Decree makes the CNIA a consultative and technical-advisory body to the Government on scientific, technological, innovation and information-security matters related to artificial intelligence (art. 2(1)), subordinate to the Council of Ministers (art. 5).

The CNIA advises the Government and issues opinions on AI policies, strategies, action plans and legal and regulatory proposals (art. 6(1)); the Decree gives it no power to bind a private developer or deployer of an AI system, and states no penalty. The Executive Secretariat is the ICT regulatory authority (art. 9(2)). The CNIA must publish its activity reports, opinions and recommendations every six months on a publicly accessible digital platform (art. 6(1)(v)). The Decree entered into force on the date of its publication (art. 12).

Article 2 applies the Law to natural and legal persons, public or private, that apply information and communication technologies in their activities, including electronic or commercial transactions and electronic government. Article 63(1) requires any data controller who electronically collects, processes, or discloses personal data to keep it accurate, complete, and up to date.

Article 63(2) requires the objectives for which personal data are collected and the data processor's identity to be specified before collection, and limits later use to those stated objectives. Article 63(5) requires the data processor to protect personal data against risk, loss, unauthorised access, destruction, use, modification, or disclosure.

Article 63(7) applies this chapter without prejudice to the article 40 rules on electronic advertising and marketing and to any specific legislation on electronic data protection, and article 63(8) exempts electronic collection, processing, or disclosure of personal data for journalism, artistic or literary expression, or when decided by the competent authorities to safeguard public security and national defence.

Article 64 bars accessing computerised archives, files, records, or databases to learn a third party's personal data, and bars transferring personal data between information systems belonging to distinct services or institutions, except where established by legal instrument or judicial decision. Article 65(1) requires the data processor to designate one or more individuals responsible for compliance with this chapter's principles.

Article 65(3) makes the data processor responsible for personal information in its possession or custody, including information transferred to a third party for processing, subject to the same article 40, journalism, artistic-expression, and public-security exemptions as article 63. Article 75 brings the Law into force 90 days after its publication. The Law appears in the Boletim da República, I Série, n.º 5, as Lei n.º 3/2017 de 9 de Janeiro.

Article 71(4) of the Constitution gives all persons the right to access the data collected about them and to obtain its rectification.

Article 63(3) requires the data processor, where personal data was not collected from the data subject directly, to give the subject the reason for collecting it and the processor's identity by the time the data is first disclosed to a third party. Article 63(4) excuses that notice where it is impossible, involves a disproportionate effort, is permitted by law, or the data is registered for statistical, historical, or scientific purposes.

Article 63(6) gives every person the right to obtain confirmation from a data controller of whether it holds data about them, to be told about that data within a reasonable period on payment of a fee, to receive a reasoned refusal where a request under either of those points is denied, and, where they object to data concerning them and the objection is accepted, to have it removed, rectified, completed, or altered.

Article 65(2) requires the data processor to make available to any person specific information about its policies and practices for managing personal information, including who is responsible for those policies and to whom a complaint or question should be directed, how to obtain access to personal information the processor retains, and a description of the type of personal information retained, including a general report of its use.

Article 75 brings the Law into force 90 days after its publication. The Law appears in the Boletim da República, I Série, n.º 5, as Lei n.º 3/2017 de 9 de Janeiro.

Article 66 states that the contraventions in this chapter are punishable under the following articles, without prejudice to a more severe penalty under separate criminal legislation. Article 67(m) makes violating the data-protection duty, meaning the data processor's obligations under this Law, a punishable contravention alongside a list of computer-misuse contraventions.

Article 68(c) sets the fine for that contravention, along with five other listed contraventions, at 30 to 90 times the public-service minimum wage, unless a more severe penalty applies under separate criminal legislation.

Article 69(1) gives the entidade reguladora, identified by article 11(2) as the National Institute of Information and Communication Technologies (INTIC), the power to process and decide the contravention proceeding, and article 69(2) leaves the procedural regime for contraventions to be regulated by the Council of Ministers.

Article 70(1) lets a sanction from a contravention be appealed directly to the judicial court of the relevant jurisdiction, or challenged first by a complaint to the minister overseeing information technology, and article 70(2) sends an appeal from any other decision to the Administrative Court. Article 75 brings the Law into force 90 days after its publication. The Law appears in the Boletim da República, I Série, n.º 5, as Lei n.º 3/2017 de 9 de Janeiro.

Article 71(1) of the Constitution prohibits using computer means to record and process individually identifiable data on political, philosophical or ideological convictions, religious faith, party or trade union membership, and private life.

Article 2 applies the Law to natural and legal persons, public or private, that apply information and communication technologies in their activities.

Article 67 lists as contraventions: (a) illegal access to all or part of a computer system or computer network by violating security measures, with intent to obtain data or another dishonest intent; (b) illegal interception, by technical means, of private data transmissions to, from, or within a computer system or network; (c) data interference, meaning the intentional and undue damaging, deletion, deterioration, alteration, or suppression of data; (d) system interference, meaning intentionally affecting the functioning of a computer system or network through the introduction, transmission, damaging, deletion, deterioration, alteration, or suppression of data; and (e) misuse of devices, meaning intentionally and without permission causing another's loss of property through introducing, altering, deleting, or suppressing data or interfering with a computer system's or network's functioning.

Article 68(a) sets the fine for these five contraventions at 40 to 90 times the public-service minimum wage, without prejudice to a more severe penalty under separate criminal legislation. Article 69 gives the sector regulator jurisdiction to process and decide contravention cases, and Article 70 allows direct appeal to the competent judicial court.

On the text of Article 67(a), illegal access requires violating a security measure with an intent to obtain data or another dishonest intent; reading a public, unauthenticated page without defeating a security measure has not itself been held to violate this article. Article 75 brings the Law into force 90 days after its publication in the Boletim da República of 9 January 2017, which counts to 10 April 2017.

Article 7(1) excludes from copyright protection: official texts of a legislative, administrative, or judicial nature and their official translations; news of the day and reports of events of a merely informational character; mere facts and data; political speeches, unless collected in a volume by their authors; ideas, processes, operational methods, or mathematical concepts, principles, or discoveries; and titles that are a generic, necessary, or usual designation of the theme or object of a work of a given genre, or that consist exclusively of the names of historical or mythological characters or of living public figures.

Article 7(2) allows the official texts named in Article 7(1)(a) to incorporate protected works without the rightholder's prior consent and without any compensation for the incorporation. The Law repeals the prior copyright statute, Lei n.º 4/2001, de 27 de Fevereiro. Article 98 brings the Law into force 90 days after its publication on 29 June 2022, and no official notice stating the resulting day has been located.