Comprehensive regime
Lei n.º 03/2016, Protecção de Dados Pessoais
Lei n.º 03/2016, de 15 de Fevereiro de 2016, sobre a Protecção de Dados PessoaisLei n.º 03/2016 sobre a Protecção de Dados Pessoais, reproduced by the Network of African Data Protection Authorities (NADPA-RAPDP)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2023. Publisher's page: https://www.nadpa-rapdp.org/sites/default/files/2020-11/Law_3_2016_protection_of_personal_data.pdfIn force. Binds public and private bodies.
What this law does
Lei n.º 03/2016 sets São Tomé and Príncipe's general rules for processing personal data by automated or manual means, applying to a controller established in the country, one targeting activities there, one using means located there, or one whose processing engages São Toméan private or public international law.
Processing needs the holder's unequivocal authorization or one of the Law's specific grounds: contract performance, a legal obligation, the holder's vital interests, a public-interest mission, or the controller's own legitimate interest balanced against the holder's rights.
A narrower list of sensitive categories, philosophical or political belief, trade-union or religious affiliation, racial or ethnic origin, private life, health or sex life including genetic data, needs the holder's explicit authorization, a specific legal provision, or NAPPD authorization for an important public interest; biometric identifiers as such are not named among these categories.
A controller or its representative must notify the National Agency for the Protection of Personal Data (NAPPD) in writing at least eight days before starting a wholly or partly automated processing operation, and obtain NAPPD's prior authorization before processing sensitive data, credit or solvency data, interconnecting personal-data files, or repurposing data collected for another end.
Chapter III gives the data holder a right to information at collection and a right of access and rectification. A transfer of personal data outside the country needs the destination legal order to ensure an adequate level of protection, as NAPPD assesses it, unless a derogation applies (contract necessity, an important public interest, the holder's vital interests, or a public register open to consultation) or NAPPD authorizes the transfer on the strength of adequate contractual safeguards. The Law's own final provision defers its entry into force to general law without stating a day.
What it requires