The Angolan Data Protection Law (DPL) extends its applicability to data processing activities that occur within Angolan territory, even when the data controller is not established in Angola.

Text of Relevant Provisions

AO DPL Art.3(2)(d):

"2. This law applies to the processing of personal data carried out: d) By a data controller who, not being established in the Republic of Angola, uses means located in Angolan territory for the processing of personal data."

Original (Portuguese):

"2. A presente lei aplica-se ao tratamento de dados pessoais efectuados d)- Por responsável pelo tratamento que, não estando estabelecido na República de Angola, recorra, para o tratamento de dados pessoais, a meios situados em território angolano."

AO DPL Art.3(3):

"3. For the purposes of point d) of paragraph 2, a data controller is considered to use means located in Angolan territory when the operations of personal data processing are carried out with, or the personal data are hosted in, means located in Angolan territory. For the purposes of this law, the mere use of such means for the collection, registration, or transit of personal data in the territory of the Republic of Angola is sufficient."

Original (Portuguese):

"3. Para os efeitos da alínea d) do número anterior, considera-se que o responsável pelo tratamento recorre a meios situados em território angolano quando as operações de tratamento dos dados pessoais são realizadas com, ou os dados pessoais são alojados em, meios situados Publicado na Iª Série do Diário da República"

Analysis of Provisions

The Angolan DPL applies to data processing activities that occur within Angolan territory, regardless of the data controller's establishment. This is evident from Article 3(2)(d), which states that the law applies to processing carried out "By a data controller who, not being established in the Republic of Angola, uses means located in Angolan territory for the processing of personal data".

Article 3(3) further clarifies and expands this provision by defining what constitutes "using means located in Angolan territory". It encompasses two scenarios:

1. When "the operations of personal data processing are carried out with" means located in Angola.
2. When "the personal data are hosted in" means located in Angola.

Importantly, the law sets a low threshold for applicability, stating that "the mere use of such means for the collection, registration, or transit of personal data in the territory of the Republic of Angola is sufficient". This broad interpretation significantly extends the law's reach to include even temporary or transient data processing activities within Angola.

The rationale behind this provision is to ensure comprehensive protection of personal data processed within Angolan territory, regardless of the data controller's location. This approach prevents potential loopholes where foreign entities could process Angolan residents' data within the country without being subject to its data protection regulations.

Implications

This provision has several important implications for businesses:

1. Foreign companies: Non-Angolan companies that use any means (e.g., servers, data centers) located in Angola for data processing activities fall under the law's scope, even if they have no permanent establishment in the country.
2. Cloud services: Companies using cloud services with data centers in Angola may be subject to the law, even if they are unaware of the exact location of their data processing.
3. Data transit: Even the mere transit of personal data through Angolan territory (e.g., through network infrastructure) could potentially trigger the law's applicability.
4. Compliance requirements: Foreign entities processing data in Angola must comply with all aspects of the Angolan DPL, including potentially appointing a local representative as per Article 3(4).
5. Due diligence: Companies must conduct thorough assessments of their data processing activities to determine if they use any means located in Angola, directly or indirectly.
6. Data localization considerations: This provision may incentivize some companies to avoid using means located in Angola for data processing to stay outside the law's scope, potentially impacting the local data processing industry.

These implications underscore the importance for both domestic and international companies to carefully consider their data processing activities in relation to Angolan territory to ensure compliance with the DPL.