Cybersecurity law & regulation in Cape Verde (2026)

Legal framework

Decreto-Lei n.º 9/2021 of 29 January 2021 (General Legal Regime for Cybersecurity in Cabo Verde), complemented by Law n.º 8/IX/2017 (Cybercrime Law), Law n.º 121/IX/2021 (Data Protection), and overseen by the Centro Nacional de Cibersegurança (CNCS) and CSIRT.CV

Key points: cybersecurity in Cape Verde

1. 01Comprehensive Cybersecurity Law (2021)

   Decreto-Lei n.º 9/2021 of 29 January 2021 enacted a general legal regime for cybersecurity applicable to public administration, critical infrastructure operators, essential service operators, and digital service providers. It establishes mandatory security measures, incident-reporting obligations, and penalties (fines of CVE 20,000-1,000,000 depending on actor type).

   mf.gov.cv lexology.com

2. 02National Authority: CNCS & CSIRT.CV

   The same decree established the Centro Nacional de Cibersegurança (CNCS) for strategic oversight and Decreto Regulamentar n.º 1/2021 created CSIRT.CV as the national computer security incident response team for both public and private entities. A national Security Operations Centre (SOC) was subsequently activated within the State's Private Technological Network (RTPE).

   governacaodigital.gov.cv ecofinagency.com

3. 03Cybercrime Law (2017)

   Law n.º 8/IX/2017 (in force March 2017) establishes substantive and procedural criminal law covering cybercrime offences and electronic evidence, developed in alignment with the Budapest Convention. Cabo Verde is one of a small group of African states to have ratified the Budapest Convention.

   coe.int cyberportal.ecowas.int

4. 04Breach Notification Duties

   Under Law n.º 121/IX/2021 (amended Data Protection Law), data controllers must notify the national data protection authority (CNPD) of personal data breaches within 72 hours of becoming aware, unless the breach poses no risk. High-risk breaches must also be communicated to affected data subjects. The CNCS regime additionally requires notification of cybersecurity incidents with significant impact.

   dlapiperdataprotection.com dataguidance.com

5. 05National Cybersecurity Strategy

   A National Cybersecurity Strategy was adopted in February 2016 as a four-year plan identifying legislative, institutional, and operational priorities. Its implementation led to the 2017 cybercrime law and the 2021 cybersecurity decree-law. Cabo Verde's ITU Global Cybersecurity Index ranking improved by 27 positions following the 2021 reforms.

   cyberportal.ecowas.int mf.gov.cv

6. 06Regional & International Commitments

   Cabo Verde is party to the Budapest Convention on Cybercrime and an ECOWAS member bound by the 2021 ECOWAS Regional Cybersecurity and Cybercrime Strategy. Cabo Verde also participated in the African Union Malabo Convention process. Ongoing capacity-building programmes (e.g., LuxDev training, 2023-2024) support implementation.

   rm.coe.int cyberportal.ecowas.int

Sources

1. 1.mf.gov.cv/documents/20126/0/bo_29-01-2021_+Regime+juri%CC%81dico+cabo-verdiano+
2. 2.governacaodigital.gov.cv/decreto-lei-de-estruturacao-do-cncs-centro-nacional-deciberseguranca/
3. 3.lexology.com/library/detail.aspx?g=25f79b9c-770b-40ed-97cc-7c179772e440
4. 4.coe.int/en/web/octopus/-/cabo-verde
5. 5.cyberportal.ecowas.int/member-states/cabo-verde/
6. 6.dlapiperdataprotection.com/index.html?t=breach-notification&c=CV
7. 7.dataguidance.com/notes/cape-verde-data-protection-overview
8. 8.ecofinagency.com/news-digital/3110-50013-cape-verde-steps-up-cybersecurity-efforts-wit
9. 9.mf.gov.cv/web/mf/-/cabo-verde-sobe-27-posi%C3%A7%C3%B5es-no-%C3%ADndice-global-
10. 10.rm.coe.int/090000168073ce00