Use of Equipment Within Angola as an Applicability Factor of the Angolan Data Protection Law

The Angolan Data Protection Law (AO DPL) establishes the use of equipment within its jurisdiction as a factor determining its applicability to data controllers not established in Angola.

Text of Relevant Provisions

AO DPL Art.3(2)(d):

"2. This law applies to the processing of personal data carried out: d) By a data controller who, not being established in the Republic of Angola, uses means located in Angolan territory for the processing of personal data."

Original (Portuguese):

"2. A presente lei aplica-se ao tratamento de dados pessoais efectuados d)- Por responsável pelo tratamento que, não estando estabelecido na República de Angola, recorra, para o tratamento de dados pessoais, a meios situados em território angolano."

AO DPL Art.3(3):

"3. For the purposes of point d) of paragraph 2, a data controller is considered to use means located in Angolan territory when the operations of personal data processing are carried out with, or the personal data are hosted in, means located in Angolan territory. For the purposes of this law, the mere use of such means for the collection, registration, or transit of personal data in the territory of the Republic of Angola is sufficient."

Original (Portuguese):

"3. Para os efeitos da alínea d) do número anterior, considera-se que o responsável pelo tratamento recorre a meios situados em território angolano quando as operações de tratamento dos dados pessoais são realizadas com, ou os dados pessoais são alojados em, meios situados Publicado na Iª Série do Diário da República"

Analysis of Provisions

The Angolan Data Protection Law extends its applicability to data controllers not established in Angola through the "Use of Equipment Within Jurisdiction" factor. Article 3(2)(d) explicitly states that the law applies to processing carried out "By a data controller who, not being established in the Republic of Angola, uses means located in Angolan territory for the processing of personal data."

Article 3(3) further clarifies what constitutes "using means" in Angolan territory. It encompasses two scenarios:

1. When "operations of personal data processing are carried out with" means located in Angola.
2. When "personal data are hosted in" means located in Angola.

Importantly, the provision emphasizes that "the mere use of such means for the collection, registration, or transit of personal data in the territory of the Republic of Angola is sufficient" to trigger the law's applicability. This broad interpretation ensures that even minimal use of equipment or infrastructure within Angola for data processing falls under the law's scope.

The rationale behind this factor is to ensure comprehensive protection of personal data processed within Angolan territory, regardless of the controller's location. It prevents companies from circumventing Angolan data protection regulations by simply establishing themselves outside the country while still processing data using Angolan infrastructure.

Implications

This provision has significant implications for businesses operating globally:

1. Companies not established in Angola but using servers, data centers, or other processing equipment located in Angola will be subject to the Angolan Data Protection Law. The broad language of "means located in Angolan territory" suggests that any form of equipment or infrastructure used for data processing could potentially bring a controller under the law's scope. So, cloud service providers with data centers in Angola may inadvertently bring their clients under Angolan jurisdiction if personal data is processed or stored in these facilities.
2. Even temporary or transient use of Angolan infrastructure for data collection, registration, or transit is sufficient to trigger the law's applicability.
3. Data collection: Foreign entities collecting data from Angolan residents using equipment in Angola (e.g., through mobile apps or IoT devices) would be subject to the law.
4. Companies must carefully consider their data processing infrastructure and potentially reassess their data flows to determine if they fall under Angolan jurisdiction.