Law on the Protection of Personal Data, cross border transfer

Lei n.º 22/11, de 17 de Junho de 2011, arts. 33-34 (transferência internacional de dados)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Notify the Agência de Protecção de Dados before transferring personal data to a country that ensures a level of protection at least equal to this law's, and expect the APD to assess adequacy by the nature, purpose and duration of the processing, the destination country and the legal, professional and security rules in force there.
Before transferring personal data to a country that does not ensure an adequate level of protection, obtain the APD's authorisation on one of the law's listed grounds, such as the data subject's unequivocal, express and written consent, an applicable international treaty, humanitarian aid, contractual necessity, an important public interest or legal claim, the data subject's vital interests, a publicly accessible source, or the recipient's contractual guarantee of adequate protection on APD-set terms.
Rely on uniform, binding internal privacy and data protection rules to satisfy the adequate protection requirement for a transfer between companies of the same corporate group.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 33 subjects the international transfer of personal data to a country that ensures a level of protection at least equal to this law's to notification to the APD, which decides whether a state provides that level by weighing the nature of the data, the purpose and duration of the processing, the destination country, and the legal, professional and security rules in force there.

Article 34 conditions transfer of personal data to a country that does not ensure an adequate level of protection on the APD's authorisation, granted only where the data subject has given unequivocal, express and written consent, an international treaty or agreement to which Angola is party applies, the transfer answers a humanitarian aid request, the transfer is necessary for a contract with or for the benefit of the data subject, the transfer serves an important public interest or a legal claim, the transfer protects the data subject's vital interests where they cannot consent, the data originates from a publicly accessible source, or the recipient contractually guarantees the transferred data an adequate level of protection on terms the APD sets.

Article 34 also lets a group of companies satisfy the adequate protection requirement for transfers between them through binding uniform internal rules on privacy and data protection.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Text of Lei n.º 22/11 (Lei da Protecção de Dados Pessoais), reproduced by AngoLex

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app