Sao Tome and PrincipeLei n.º 03/2016, sensitive categories and suspect records
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force.
A sensitive categories rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Before processing a sensitive category of data (political, religious, trade-union or philosophical affiliation, racial or ethnic origin, private life, health, sex life, or genetic data), obtain the holder's explicit authorization, rely on a specific legal provision, or obtain NAPPD authorization for an important public interest.
- Where you process health or sex-life data, including genetic data, for preventive medicine, diagnosis, care or health-service management, do so only through a health professional or another person bound by professional secrecy, notify NAPPD of the processing, and secure it with appropriate information-security measures.
- Obtain NAPPD's prior authorization before processing sensitive personal data under the public-interest ground, and before processing data on a person suspected of a crime or an administrative offense, or on a penalty, security measure, fine or ancillary sanction imposed on them.
- Maintain a central record of persons suspected of unlawful activity, a criminal offense or an administrative offense, and of penalties, security measures, fines or ancillary sanctions, only where you are a public service with specific legal competence to do so, and limit any processing for police investigation to what a specific danger or offense requires.
- Put in place the special safety measures the Law requires for sensitive or credit data: control of premises entry, data-carrier handling, unauthorized disclosure, system access, transmission, and data-entry logging, and keep health and sex-life data logically separated from other personal data.
What it reaches
Obligation class
Consent, Security, Access restriction
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 7(1) defines a sensitive category as data on philosophical or political belief, membership of a political or trade-union association, religious belief, private life, racial or ethnic origin, health or sex life, including genetic data; biometric identifiers as such are not named among these categories.
Article 7(2) permits processing this data only under a legal or organic provision that expressly authorizes it, NAPPD's authorization for an important public interest indispensable to its own attributions, or the holder's explicit authorization, and Article 7(3) adds narrower grounds: protecting the vital interests of a person unable to consent, processing by a political, philosophical, religious or trade-union body about its own members with their consent, data the holder has manifestly made public, or a judicial defense.
Article 7(4) permits processing health or sex-life data, including genetic data, for preventive medicine, diagnosis, care or health-service management only through a health professional or another person bound by secrecy, notified to NAPPD under Article 21, and secured by appropriate information-security measures.
Article 8 restricts the central record of persons suspected of unlawful activity, a criminal offense or an administrative offense, and of the penalties, security measures, fines or ancillary sanctions imposed on them, to a public service with specific legal competence, and limits processing for police investigation to what a specific danger or offense requires.
Article 16 requires the controllers covered by Articles 7(2) and 8 to take special safety measures: controlling entry to their premises, preventing unauthorized reading, copying, alteration or removal of data carriers, preventing unauthorized disclosure or alteration, controlling system access and data transmission, logging who enters data and when, and keeping health and sex-life data logically separate from other personal data; NAPPD may also require encryption where transmission over the Article 7 network would otherwise put the holders' rights at risk.
When LexLint raises it
processes_biometricshandles_health_recordshigh_risk_decisions
Read the law
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www.nadpa-rapdp.org/sites/default/files/2020-11/Law_3_2016_protection_of_personal_data.pdfEvery line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.