Law on the Protection of Personal Data
Lei n.º 22/11, de 17 de Junho de 2011 (Protecção de Dados Pessoais)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
A comprehensive regime rule binding public and private bodies.
As of 7 September 2026.
What it requires
- Obtain the data subject's unequivocal, express consent before processing their personal data, or notify the Agência de Protecção de Dados, unless a contract-performance, legal-obligation, vital-interest, public-interest, or legitimate-interest ground applies.
- Obtain the data subject's written consent or the APD's authorisation before processing sensitive data (philosophical or political convictions, party or union membership, religious faith, private life, racial or ethnic origin, or health and sex life including genetic data).
- Give the data subject access to, and let them rectify, update, or object to the processing of, their personal data on request, and do not base a legal-effect decision solely on automated processing.
- Do not transfer personal data to a state that does not ensure an adequate level of protection without the APD's authorisation.
- Do not access personal data whose access is barred to you without authorisation.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Unauthorised access to personal data whose access is barred to the actor draws imprisonment of six months to two years or a corresponding fine (Article 56), prosecuted only on the victim's complaint; the offence is aggravated where achieved by defeating security measures or targeting sensitive-category data (Articles 13 to 16).
Who enforces it
Enforcement body
Agência de Protecção de Dados (APD)
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Transfer, Licensing, Access restriction
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 3 subjects to the law any processing of personal data by any person or entity in the public, private, or cooperative sector, including a controller not established in Angola who uses means located there.
Article 12 requires the data subject's unequivocal, express consent before most processing, or notification to the APD, unless the processing falls under one of Article 12's enumerated exceptions (contract performance, a legal obligation, vital interests, a public-interest mission, or the controller's legitimate interest).
Articles 13 to 16 impose heightened requirements, generally the data subject's written consent or APD authorisation, for sensitive data, health and sex-life data, data on unlawful activity, and credit and solvency data (the last exempted where the information comes from a publicly accessible source).
Articles 25 to 29 give the data subject rights of information, access, objection, rectification, updating, and elimination, and bar a decision producing legal effects from resting solely on automated processing. Articles 33 and 34 bar transferring personal data to a state that does not ensure an adequate level of protection absent APD authorisation. Article 44 establishes the Agência de Protecção de Dados (APD) to supervise compliance and receive notifications and authorisation requests.
Article 51 makes contravention of specified duties (Articles 14 to 17, 20, 30 to 32) punishable by a fine of USD 75,000 to USD 150,000 in the equivalent national currency, the first of several graduated tiers the article sets. Article 56 makes unauthorised access to personal data whose access is barred to the actor a crime punishable by six months to two years' imprisonment or the corresponding fine, prosecuted only on complaint.
Article 48 gives any person who suffers moral or patrimonial harm from misuse of their personal data the right to seek judicial reparation.
When LexLint raises it
crawls_webtrains_modelsautomated_outreachhigh_risk_decisions
Read the law
Text of Lei n.º 22/11 (Lei da Protecção de Dados Pessoais), reproduced by AngoLex