Angola

Article 198(2) punishes with imprisonment of two to ten years a person who produces child pornography to be spread through an information system, or who offers, makes available, disseminates, or transmits it through an information system.

Article 198(5)(a) defines 'child pornography' for this purpose as any material that visually or aurally represents a minor under 18, or a person, real or virtual, appearing to be a minor under 18, engaged in sexually explicit conduct or conduct that incites such conduct. Because the definition expressly reaches a 'virtual' person merely appearing to be a minor, the offence covers a wholly synthetic, AI-generated depiction with no real child involved, not only material derived from a real child.

Article 198(1) separately punishes conduct that exposes a minor under 18 to obscene material or uses or procures a minor for pornographic photography, film, or recording. Article 198(3) punishes acquiring, possessing, or facilitating access to child-pornography material by any means with imprisonment of one to five years. Article 198(4) raises the penalty to three to ten years where the actor makes a profession or profit of the conduct described.

Article 3 subjects to the law any processing of personal data by any person or entity in the public, private, or cooperative sector, including a controller not established in Angola who uses means located there.

Article 12 requires the data subject's unequivocal, express consent before most processing, or notification to the APD, unless the processing falls under one of Article 12's enumerated exceptions (contract performance, a legal obligation, vital interests, a public-interest mission, or the controller's legitimate interest).

Articles 13 to 16 impose heightened requirements, generally the data subject's written consent or APD authorisation, for sensitive data, health and sex-life data, data on unlawful activity, and credit and solvency data (the last exempted where the information comes from a publicly accessible source).

Articles 25 to 29 give the data subject rights of information, access, objection, rectification, updating, and elimination, and bar a decision producing legal effects from resting solely on automated processing. Articles 33 and 34 bar transferring personal data to a state that does not ensure an adequate level of protection absent APD authorisation. Article 44 establishes the Agência de Protecção de Dados (APD) to supervise compliance and receive notifications and authorisation requests.

Article 51 makes contravention of specified duties (Articles 14 to 17, 20, 30 to 32) punishable by a fine of USD 75,000 to USD 150,000 in the equivalent national currency, the first of several graduated tiers the article sets. Article 56 makes unauthorised access to personal data whose access is barred to the actor a crime punishable by six months to two years' imprisonment or the corresponding fine, prosecuted only on complaint.

Article 48 gives any person who suffers moral or patrimonial harm from misuse of their personal data the right to seek judicial reparation.

Article 438(1) punishes any person who, without authorisation, accesses all or part of an information system of which they are not the holder, with imprisonment of up to two years or a fine of up to 240 days.

Article 438(2) raises the penalty to imprisonment of two to eight years where the access is achieved by defeating security measures, or is directed at a 'serviço protegido' (a service whose access is conditional on a subscription or other prior individual authorisation, as Lei n.º 7/17 art. 4(a) defines the term).

Article 438(3) applies the same heavier tier where the actor learns a commercial or industrial secret or confidential data protected by law, or obtains a benefit or advantage of elevated value. Article 438(4) extends the base penalty to a person who, without due authorisation, processes individually identifiable data or transmits it to a third party for a purpose other than the one authorised.

Article 437 defines 'sistema informático' broadly as any device or set of interconnected devices that automates the processing of computer data, together with the network supporting communication between them.

The offence draws no distinction based on whether the accessed system or page is public and unauthenticated, so a plain reading exposes web crawling that accesses a system without the holder's authorisation, regardless of whether a technical barrier was defeated, though the enhanced tier under Article 438(2) requires either a security-measure violation or a conditional-access service.

Lei n.º 7/17 (Lei de Protecção das Redes e Sistemas Informáticos) imposes separate security and data-retention duties on network operators, but its own Article 44 states that, for information systems and data, subsidiarily the legal regime provided by the criminal legislation and criminal procedure legislation in force applies, referring unauthorised-access liability back to this Penal Code article rather than creating a second offence.

Article 51(1) permits, independent of the author's authorisation and without any remuneration, several uses of an already-lawfully-disclosed work provided its title and the author's name are stated and its genuineness and integrity respected. Alínea (e) of that article covers quoting short fragments of another's work, in written, sound, or visual form, where justified on scientific, critical, didactic, or informational grounds.

Alínea (c) of the same article covers reproducing works included in filmed or televised current-events reports, or works permanently exhibited in a public place. Article 51(2) excludes several categories from the private-reproduction exception at alínea (d) of the same article, including at alínea (c) reproducing the whole or an important part of a database in digital form.

Article 45 gives the holder of a database's patrimonial right the exclusive right to authorise or prohibit reproduction, translation, adaptation, or distribution of the database's structure. WIPO Lex records that the Law entered into force 30 days after its 31 July 2014 publication, per the Law's own Article 95 on entry into force.

Article 92's repeal clause revokes Lei n.º 4/90, de 10 de Março, the prior copyright statute, applying the new Law to any dispute not yet finally decided to the extent that benefits the author.