Data protection & privacy law in Angola (2026)

Legal framework

Lei n.º 22/11 de 17 de Junho (Lei de Proteção de Dados Pessoais, LPDP), enforced by the Agência de Proteção de Dados (APD)

Key points: data & privacy in Angola

1. 01Primary Legislation

   Law No. 22/11 of 17 June 2011 is the omnibus data protection statute. It applies to all natural and legal persons, public, private, and cooperative, processing personal data in Angola or using equipment subject to Angolan law.

   apd.ao minttics.gov.ao

2. 02Supervisory Authority

   The Agência de Proteção de Dados (APD), headquartered in Luanda, is the independent authority responsible for monitoring compliance, conducting inspections, and imposing sanctions. It became operational in October 2019 under Presidential Decree No. 214/16.

   apd.ao apd.ao

3. 03Core Obligations

   Controllers must obtain express consent from data subjects and notify the APD before processing. Processing must comply with principles of transparency, lawfulness, proportionality, purpose limitation, accuracy, and storage limitation. Cross-border transfers require APD authorisation.

   dlapiperdataprotection.com cms.law

4. 04Data Subject Rights

   Individuals hold rights of access, rectification, and erasure of their personal data. The law also grants the right to object to processing in certain circumstances.

   dlapiperdataprotection.com plmj.com

5. 05Active Enforcement (2024-2025)

   The APD imposed fines on multiple organisations: USD 150,000 on MAXAM for unlawful cross-border transfer to the UK (2024); USD 75,000 on Banco Comercial do Huambo for inadequate security measures (2024); and USD 175,000 on airline TAAG plus USD 75,000 on Banco de Desenvolvimento de Angola (BDA) for security failures (2025).

   plmj.com expansao.co.ao

6. 06Pending Reform

   The APD submitted a draft revision of Law No. 22/11 for public consultation from 17 March to 17 April 2025. The revision aims to modernise the framework for AI and emerging technologies; formal legislative adoption was pending as of mid-2025.

   digitalpolicyalert.org apd.ao

Timeline of decisions

1. 17 Mar 2025Law
   APD Opens Public Consultation on Draft Revision of Law 22/11

   Angola's data protection regulator launched a 30-day public consultation (17 March, 17 April 2025) on a comprehensive overhaul of the 2011 data protection law, the first formal attempt to modernise the framework and align it with contemporary international standards.

   CMS Expert Guide – Angola

2. 25 Oct 2024Guidance
   APD Circular 02/APD/2024: Mandatory Immediate Data Breach Notification

   The APD issued its first standalone breach-notification circular, requiring all public and private entities to immediately report personal data breaches to the agency with minimum prescribed content (nature, consequences, and remediation measures), significantly tightening enforcement expectations.

   PLMJ – Informative Notes

3. 19 Jul 2024Enforcement
   APD Deliberations 004-005/2024: Fines Against MAXAM, BCH and COSAL

   By Deliberations 004/2024 and 005/2024, the APD fined MAXAM USD 150,000 for unlawful data transfer to the UK and failure to notify; BCH USD 75,000 for inadequate technical measures following a cyberattack; and COSAL USD 75,000 for a September 2023 ransomware incident, demonstrating a sustained rise in enforcement activity.

   RAPDP – Angola Enforcement Decisions

4. 1 Oct 2019Decision · official
   Angola's Data Protection Agency (APD) Formally Established

   Eight years after Law 22/11 was enacted, Angola's dedicated supervisory authority, the Agência de Proteção de Dados (APD), was finally constituted in October 2019, beginning enforcement of data protection rules that also govern personal data processed by AI systems.

   Agência de Proteção de Dados (APD) — Angola

5. 1 Oct 2019Decision
   APD Governing Bodies Take Office, Agency Becomes Operational

   Eight years after Law 22/11 was enacted, the APD finally became operationally active when its board, nominated by Presidential Decree 277/2019 (6 September 2019), assumed office, marking the true start of data-protection oversight in Angola.

   Data Protection Africa – Angola Factsheet (Sep 2019)

6. 17 Jun 2011Law
   Personal Data Protection Law (Law no. 22/11) Enacted

   Angola's foundational data privacy law, grounded in Article 32(2) of the Constitution, established rights to access, rectification, erasure, and objection for data subjects, and created the Angolan Data Protection Agency (APD) as the enforcement authority. The APD can levy fines from $75,000 to $150,000 and impose criminal liability on data controllers.

   OneTrust DataGuidance – Angola

7. 17 Jun 2011Law
   Law 22/11 on Personal Data Protection Enacted

   Angola's National Assembly enacted its foundational data protection law, modelled on EU/Portuguese frameworks, establishing processing principles (transparency, proportionality, purpose limitation), data-subject rights (access, rectification, erasure, objection, anti-automated-decision), mandatory database registration with the APD, and criminal/civil penalties up to USD 150,000.

   RAPDP – Law 22/11 Full Text

8. 5 Feb 2010Law
   Constitution of Angola Enshrines Right to Privacy and Confidentiality of Communications

   Angola's post-civil-war Constitution (adopted 5 February 2010) established the constitutional bedrock for data privacy: Article 32 guarantees the right to privacy and intimacy of private life, and Article 34 protects confidentiality of communications, the foundation upon which all subsequent data-protection legislation rests.

   Constitute Project – Angola Constitution 2010

Sources

1. 1.apd.ao/ao/
2. 2.apd.ao/ao/legislacao/
3. 3.apd.ao/fotos/frontend_1/editor2/110617_lei_22-11_de_17_junho-proteccao_de_da
4. 4.minttics.gov.ao/ao/documentos/lei-n-22-11/
5. 5.dlapiperdataprotection.com/index.html?t=law&c=AO
6. 6.cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
7. 7.plmj.com/en/knowledge/informative-notes/Personal-Data-and-Cybersecurity-in-Ang
8. 8.expansao.co.ao/empresas/detalhe/agencia-de-proteccao-de-dados-multa-taag-e-bda-em-25
9. 9.digitalpolicyalert.org/blog/data-protection-in-africa-roundup