Skip to content
World Watch

Data protection & privacy law in Cape Verde (2026)

Data protection in Cape Verde: comprehensive law.

Cape Verde enacted Africa's first comprehensive data protection law in 2001 (Law 133/V/2001), subsequently modernised by amendments in 2013 and 2021. The 2021 amendment (Law 121/IX/2021) aligned the framework with GDPR principles, introducing rights to erasure, data portability, restriction of processing, extraterritorial scope, and mandatory breach notification. The independent supervisory authority, CNPD, has been operational since 2015 and enforces compliance.

Last verified Official sources first · MethodologyCompare Cape Verde with other countries

Legal framework

Law 133/V/2001 (Data Protection Act, as amended by Law 41/VIII/2013 and Law 121/IX/2021); supervisory authority: Comissão Nacional de Proteção de Dados (CNPD)

Key points: data & privacy in Cape Verde

  1. Primary legislation

    Law 133/V/2001 of 22 January 2001 is the foundational data protection statute, making Cape Verde the first African country with comprehensive data protection legislation. It has been amended twice: by Law 41/VIII/2013 (17 September 2013) and Law 121/IX/2021 (17 March 2021).

    cnpd.cv cnpd.cv

  2. Supervisory authority (CNPD)

    The Comissão Nacional de Proteção de Dados (CNPD) was established as an independent administrative authority by Law 42/VIII/2013 and became operational in 2015. It monitors compliance, handles complaints, and is a member of NADPA (Network of African Data Protection Authorities).

    cnpd.cv rapdp.org

  3. 2021 GDPR-aligned amendments

    Law 121/IX/2021 introduced GDPR-style provisions: explicit affirmative consent, rights to erasure, data portability, and restriction of processing, as well as extraterritorial applicability to controllers/processors outside Cape Verde that process data of individuals located in the country.

    legalmca.com furtherafrica.com

  4. Data subject rights

    Individuals hold rights to be informed, access, rectification, erasure/destruction, restriction of processing, portability, and objection (including to direct marketing). These rights are enforceable against data controllers and processors.

    dataguidance.com advogados.cv

  5. Breach notification obligations

    Controllers and processors must notify the CNPD of personal data breaches. Where a breach poses a high risk to the rights and freedoms of data subjects, affected individuals must also be directly notified.

    legalmca.com dlapiperdataprotection.com

  6. Sanctions and enforcement

    Fines for first-time violations range from CVE 1 million to CVE 100 million, escalating to CVE 100-300 million for repeat offences. The CNPD has investigatory and corrective powers under Law 42/VIII/2013.

    dlapiperdataprotection.com dataprotection.africa

Sources

  1. cnpd.cv/wp-content/uploads/2025/03/DATA-PROTECTION-Law-133.pdf
  2. cnpd.cv/leis/Lei%20121.IX.2021%20altera%C3%A7%C3%A3o%20Lei%2041.VIII.2013.pdf
  3. cnpd.cv/legislacao/
  4. cnpd.cv/o-que-somos-e-quem-somos/
  5. rapdp.org/en/node/41
  6. legalmca.com/en_GB/2021/04/30/amendment-of-the-law-on-personal-data-protection-in-
  7. furtherafrica.com/2021/04/30/amendment-of-the-law-on-personal-data-protection-in-cape-v
  8. dlapiperdataprotection.com/index.html?t=law&c=CV
  9. dataprotection.africa/cabo-verde/
  10. dataguidance.com/notes/cape-verde-data-protection-overview
  11. advogados.cv/en/data-protection-in-cape-verde-what-the-law-says/

Next for Cape Verde: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026