Angola - Law No. 22/11 on Personal Data Protection (2011)

Law No. 22/11 of 17 June 2011 regulates personal data protection in Angola alongside the Electronic Communications Law (23/11) and the Information Systems Protection Law (7/17). It applies to natural and juristic persons, public and private, and requires prior express consent plus prior notice to the APD for ordinary processing, and prior APD authorisation with a legal enabling provision for sensitive data (beliefs, politics, religion, private life, ethnicity, health, sex life, genetic data). International transfers to countries with adequate protection require prior notification to the APD; transfers to non-adequate countries require prior authorisation, including intra-group and cloud transfers.

Although the law dates from 2011, the APD only became operational after its board was appointed in September 2019 (Presidential Decree 277/2019), and its organic statute was set by Presidential Decree 214/2016. Enforcement has since hardened: in deliberations 003/2026 and 004/2026 of 18 June 2026, the APD fined one company the kwanza equivalent of USD 505,000 for processing clients' data and storing data in a foreign cloud without notification or authorisation, and another the equivalent of USD 112,000 for inadequate security measures and failure to notify. A draft revision of Law 22/11 underwent public consultation from 17 March to 17 April 2025. There is no DPO requirement under the current law, though the APD has announced a forthcoming DPO registration scheme.