The Angolan Data Protection Law (AO DPL) applies to various data processing activities determined by both material and territorial factors. Materially, the law covers processing by automated means and manual processing within or intended for filing systems. Territorially, it applies to data controllers based in Angola, those with establishments in Angola, and foreign entities using equipment or means located in Angola for data processing.

Material Applicability Factors

The AO DPL establishes its material applicability based on specific criteria related to the nature of data processing activities. The key material applicability factors discussed in this section are:

• Filing System Criterion
• Prospective Filing System Inclusion
• Automated Means Criterion

Filing System Criterion

Relevant Provision

AO DPL Article 2:

"This law applies to the processing of personal data carried out by fully or partially automated means or personal data contained in or intended for manual files."

Original (Portuguese):

"A presente lei aplica-se ao tratamento de dados pessoais efectuado por meios automatizados, total ou parcialmente, ou de dados pessoais contidos em ou destinados a ficheiros manuais."

Analysis

The AO DPL applies to the processing of personal data contained in or intended for manual files, establishing the Filing System Criterion as a factor of material applicability. The inclusion of manual files means that the law covers non-automated processing when the personal data is organized in a structured manner, allowing for easy retrieval based on specific criteria.

By stating that the law applies to personal data "contained in or intended for manual files", the legislation ensures that traditional, non-digital records are subject to data protection obligations when they form part of an organized filing system.

Implications

Organizations maintaining manual records or files that systematically organize personal data must comply with the AO DPL. This includes paper-based files, card indexes, or any non-automated records where personal data is accessible according to specific criteria.

---

Prospective Filing System Inclusion

Relevant Provision

AO DPL Article 2:

"This law applies to the processing of personal data carried out by fully or partially automated means or personal data contained in or intended for manual files."

Original (Portuguese):

"A presente lei aplica-se ao tratamento de dados pessoais efectuado por meios automatizados, total ou parcialmente, ou de dados pessoais contidos em ou destinados a ficheiros manuais."

Analysis

The AO DPL extends its applicability to personal data intended for inclusion in manual files, establishing the Prospective Filing System Inclusion factor. This provision captures data that is being collected or processed with the intention of being added to an organized manual filing system, even if it has not yet been formally incorporated.

By including data "intended for manual files", the law ensures that data protection principles apply from the point of data collection, promoting proactive compliance and safeguarding personal data throughout its lifecycle.

Implications

Entities collecting personal data for future inclusion in manual filing systems are subject to the AO DPL. This requires organizations to implement appropriate data protection measures during the initial stages of data handling, not just after the data has been formally organized.

---

Automated Means Criterion

Relevant Provision

AO DPL Article 2:

"This law applies to the processing of personal data carried out by fully or partially automated means or personal data contained in or intended for manual files."

Original (Portuguese):

"A presente lei aplica-se ao tratamento de dados pessoais efectuado por meios automatizados, total ou parcialmente, ou de dados pessoais contidos em ou destinados a ficheiros manuais."

Analysis

The law applies to processing carried out by fully or partially automated means, establishing the Automated Means Criterion. This includes any processing involving electronic systems, computers, or digital technologies, whether the processing is entirely automated or involves some human intervention.

By covering processing "carried out by fully or partially automated means", the AO DPL encompasses a wide range of digital data processing activities, ensuring that modern technological methods of handling personal data are regulated.

Implications

Organizations using electronic systems for processing personal data must comply with the AO DPL. This includes activities such as data entry into databases, automated decision-making processes, and any use of software applications for managing personal data.

---

Territorial Applicability Factors

The AO DPL defines its territorial scope based on factors related to the location of data controllers and the means used for data processing. The key territorial applicability factors discussed in this section are:

• Entity's Link or Presence in Jurisdiction
• Processing in Context of Local Establishment
• Processing in Jurisdiction
• Use of Equipment Within Jurisdiction

Entity's Link or Presence in Jurisdiction

Relevant Provision

AO DPL Article 3(2)(a):

"2. This law applies to the processing of personal data carried out: a) By a data controller based in the Republic of Angola;"

Original (Portuguese):

"2. A presente lei aplica-se ao tratamento de dados pessoais efectuados: a) Por responsável pelo tratamento sedeado na República de Angola;"

Analysis

The law applies to data processing activities conducted by data controllers based in the Republic of Angola, establishing the Entity's Link or Presence in Jurisdiction factor. This means that any data controller with its headquarters or principal place of business in Angola is subject to the AO DPL, regardless of where the actual data processing occurs.

By focusing on the data controller's base, the law ensures that organizations established in Angola adhere to national data protection standards in all their processing activities.

Implications

Entities headquartered or established in Angola must comply with the AO DPL for all personal data processing activities, even if the processing takes place abroad. This requires such organizations to implement data protection measures consistent with Angolan law across their operations.

---

Processing in Context of Local Establishment

Relevant Provision

AO DPL Article 3(2)(b):

"2. This law applies to the processing of personal data carried out: b) In the context of the activities of a data controller established in the Republic of Angola, even if the said controller does not have its headquarters in Angolan territory;"

Original (Portuguese):

"2. A presente lei aplica-se ao tratamento de dados pessoais efectuados: b) No âmbito das actividades do responsável pelo tratamento estabelecido na República de Angola, ainda que o referido responsável não tenha a sua sede em território angolano;"

Analysis

The AO DPL extends its applicability to processing carried out in the context of activities of a data controller established in Angola, even if the controller's main headquarters are elsewhere. This establishes the Processing in Context of Local Establishment factor.

The provision focuses on the connection between the processing activities and the local establishment, ensuring that the law applies to foreign entities operating in Angola through branches, subsidiaries, or other forms of presence when processing is related to their Angolan activities.

Implications

Foreign companies with establishments in Angola must comply with the AO DPL for processing activities linked to their operations in Angola, regardless of where the processing physically occurs. This necessitates compliance measures for data processing related to the Angolan establishment.

---

Processing in Jurisdiction

Relevant Provisions

AO DPL Article 3(2)(d):

"2. This law applies to the processing of personal data carried out: d) By a data controller who, not being established in the Republic of Angola, uses means located in Angolan territory for the processing of personal data."

Original (Portuguese):

"2. A presente lei aplica-se ao tratamento de dados pessoais efectuados: d) Por responsável pelo tratamento que, não estando estabelecido na República de Angola, recorra, para o tratamento de dados pessoais, a meios situados em território angolano."

AO DPL Article 3(3):

"3. For the purposes of point d) of paragraph 2, a data controller is considered to use means located in Angolan territory when the operations of personal data processing are carried out with, or the personal data are hosted in, means located in Angolan territory. For the purposes of this law, the mere use of such means for the collection, registration, or transit of personal data in the territory of the Republic of Angola is sufficient."

Original (Portuguese):

"3. Para os efeitos da alínea d) do número anterior, considera-se que o responsável pelo tratamento recorre a meios situados em território angolano quando as operações de tratamento dos dados pessoais são realizadas com, ou os dados pessoais são alojados em, meios situados em território angolano. Para os efeitos da presente lei, é suficiente a mera utilização desses meios para a recolha, registo ou trânsito de dados pessoais no território da República de Angola."

Analysis

The AO DPL applies to processing activities that occur within Angolan territory, establishing the Processing in Jurisdiction factor. Specifically, the law covers situations where data controllers not established in Angola use means located in Angola for processing personal data.

Article 3(3) clarifies that using means located in Angola includes conducting data processing operations with equipment in Angola or hosting personal data on servers within Angola. The provision emphasizes that even the mere use of such means for collection, registration, or transit of data is sufficient to invoke the law's applicability.

Implications

Foreign entities processing personal data using infrastructure located in Angola are subject to the AO DPL. This includes scenarios where data is collected through devices in Angola, stored on Angolan servers, or transits through Angolan networks. Organizations must assess their use of Angolan means to determine compliance obligations.

---

Use of Equipment Within Jurisdiction

Relevant Provisions

AO DPL Article 3(2)(d):

"2. This law applies to the processing of personal data carried out: d) By a data controller who, not being established in the Republic of Angola, uses means located in Angolan territory for the processing of personal data."

Original (Portuguese):

"2. A presente lei aplica-se ao tratamento de dados pessoais efectuados: d) Por responsável pelo tratamento que, não estando estabelecido na República de Angola, recorra, para o tratamento de dados pessoais, a meios situados em território angolano."

AO DPL Article 3(3):

"3. For the purposes of point d) of paragraph 2, a data controller is considered to use means located in Angolan territory when the operations of personal data processing are carried out with, or the personal data are hosted in, means located in Angolan territory. For the purposes of this law, the mere use of such means for the collection, registration, or transit of personal data in the territory of the Republic of Angola is sufficient."

Original (Portuguese):

"3. Para os efeitos da alínea d) do número anterior, considera-se que o responsável pelo tratamento recorre a meios situados em território angolano quando as operações de tratamento dos dados pessoais são realizadas com, ou os dados pessoais são alojados em, meios situados em território angolano. Para os efeitos da presente lei, é suficiente a mera utilização desses meios para a recolha, registo ou trânsito de dados pessoais no território da República de Angola."

Analysis

The Use of Equipment Within Jurisdiction factor is established through the provisions that apply the AO DPL to data controllers not based in Angola but who use equipment or "means located in Angolan territory" for processing personal data.

Article 3(3) elaborates that this includes situations where data processing operations are performed using equipment in Angola or where personal data is hosted on servers within the country. The law underscores that even minimal use of such equipment, including for collection, registration, or data transit, is sufficient for the law to apply.

Implications

International organizations utilizing Angolan equipment or infrastructure for data processing are required to comply with the AO DPL. This may affect companies using Angolan data centers, cloud services, or network infrastructure. Entities must evaluate their technological operations to determine if they use equipment within Angola.

---

Conclusion

The Angolan Data Protection Law applies to a wide range of data processing activities based on both material and territorial factors. Materially, it encompasses processing by automated means and manual processing within or intended for filing systems. Territorially, the law applies to data controllers based in Angola, those with establishments in Angola, and foreign entities using equipment or means located in Angola. Organizations must carefully assess these factors to ensure compliance with the AO DPL in their data processing operations.