Quick summary
The legal framework and the CNPD
Cabo Verde’s general personal data protection regime rests on three statutes that complement one another. Law No. 133/V/2001 created the general regime, Law No. 41/VIII/2013 updated it, and Law No. 121/IX/2021 made the most far-reaching reform, bringing it closer to the European General Data Protection Regulation (GDPR). It entered into force on April 17, 2021.
Among other changes, the 2021 reform brought new rights for data subjects (such as erasure, restriction of processing and portability), the duty of privacy by design and by default, the data protection impact assessment, the data protection officer, breach notification within 72 hours, and new criminal offenses.
Enforcement is the responsibility of the National Data Protection Commission (CNPD), an independent administrative body created by Law No. 42/VIII/2013 and headquartered in Praia. The CNPD authorizes certain processing operations and transfers, receives notifications and complaints, monitors compliance with the law, imposes fines and promotes awareness.
Who is covered
The law applies to any person or organization, public or private, that processes personal data of natural persons, regardless of size. An SME, a hotel, a bank, a ministry and an association are all on the same footing. The only exception is natural persons who process data in the course of purely personal or household activities.
Territorial scope
- Organizations established in Cabo Verde. The law applies to processing carried out in the context of the activities of that establishment, even if the data is processed in another country.
- Organizations not established in Cabo Verde. It also applies to anyone who processes data of people who are in Cabo Verde, when offering them goods or services or monitoring their behavior.
- Video surveillance. Systems that capture images or sounds that make it possible to identify people are also covered.
Principles and lawfulness of processing
The principles
Data must be:
- Processed lawfully, transparently and in good faith.
- Collected for specified, explicit and legitimate purposes, and not subsequently used in a way that is incompatible with them.
- Adequate, relevant and limited to what is necessary for those purposes.
- Accurate and kept up to date.
- Kept only for as long as necessary.
When processing is permitted
Data may only be processed when there is a legal basis: the data subject’s consent, the performance of a contract, compliance with a legal obligation, the protection of vital interests, the public interest or the legitimate interests of the controller (provided they do not override the rights of the data subject).
Consent must be freely given, specific and informed, expressed by an unambiguous affirmative act, and the data subject may withdraw it at any time without detriment. Whoever processes the data must be able to demonstrate that it was obtained. For children, their own consent is valid only from the age of 16.
Special categories of data
Processing of data on political opinions, religious faith, trade union membership, racial or ethnic origin, sex life, health, and genetic and biometric data is, as a rule, prohibited, with limited exceptions: express consent, legal authorization, or authorization from the CNPD on grounds of important public interest or legitimate interest with safeguards against discrimination.
Data subject rights
Data subjects can require the organizations that process their data to respect the following rights:
| Right | What it means in practice |
|---|---|
| Information | To know who processes the data, for what purpose, on what legal basis, for how long, and to whom it is disclosed |
| Access | To confirm whether the data is being processed and obtain a copy, including the logic behind any automated decisions |
| Rectification | To have inaccurate or incomplete data corrected without undue delay |
| Erasure | To request deletion when the data is no longer necessary, consent is withdrawn, there is a justified objection, or the processing is unlawful |
| Restriction | To suspend processing while the accuracy or lawfulness of the data is being contested |
| Portability | To receive the data in a structured, commonly used and machine-readable format, and to transmit it to another controller |
| Objection | To object to processing on compelling and legitimate grounds, and to object to direct marketing free of charge |
The law also provides rules for the data of deceased persons and for the exercise of rights by representatives of minors. Confirm the exact regime in the statutes.
Obligations of organizations
Whoever decides why and how data is processed (the “controller”) must be able to demonstrate compliance. In practice, this means:
| Obligation | What it involves |
|---|---|
| Informing data subjects | Clear privacy notices at the time of collection: identity, purposes, legal basis, recipients, rights |
| Security of processing | Appropriate technical and organizational measures against unauthorized destruction, loss, alteration, disclosure or access; pseudonymization is one of the measures provided for |
| Privacy by design and by default | Considering data protection from the design stage of systems and, by default, processing only the data that is necessary |
| Records of activities | Keeping up-to-date records of purposes, categories of data, recipients, transfers and security measures, and providing them to the CNPD on request |
| Data protection impact assessment | Mandatory for high-risk processing, such as profiling with automated decisions, special categories of data on a large scale, or systematic monitoring of public areas |
| Data protection officer | Mandatory for public bodies and where the core activity requires regular and systematic monitoring on a large scale or large-scale processing of special categories of data; the officer’s identity and contact details are communicated to the CNPD |
| Processors | Written contracts with providers that process data on your behalf (hosting, email, software, accounting) |
| Data breaches | Detecting, recording and notifying within the deadlines (see below) |
Prior notification and authorization from the CNPD
Unlike the European GDPR, the Cabo Verdean regime retains prior control mechanisms exercised by the CNPD:
- Prior notification. The controller must notify the CNPD before carrying out any wholly or partly automated processing operation (or set of operations), subject to the exceptions and simplifications that the CNPD may authorize (Law No. 41/VIII/2013, art. 23). The CNPD provides a notification form on its website.
- Prior authorization. Required for processing special categories of data, data on creditworthiness and credit, for the interconnection of data, and for using data for a purpose other than the one that justified its collection (art. 24).
The form asks for, among other things, the identity of the controller, the purposes, the categories of data, the method of collection, the recipients, the interconnections, international transfers, the retention period, how rights can be exercised, and the security measures.
Personal data breaches
A data breach is a security incident that, accidentally or unlawfully, causes the destruction, loss, alteration, disclosure of or unauthorized access to personal data. A ransomware attack, an email sent to the wrong recipient or a stolen laptop containing customer data are examples.
- To the CNPD, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.
- To data subjects, without undue delay, when the risk is high. There are exemptions, for example if the data was adequately protected (encrypted) or if the risk has since been eliminated.
- What to report: the nature of the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed.
In practice, an organization without an incident response plan will struggle to meet the 72-hour deadline. That is why data protection and cybersecurity go hand in hand. If your organization is also covered by NIS2 or DORA, the incident notification deadlines under those rules run in parallel.
International transfers
Data may only be transferred to a country outside Cabo Verde if that country ensures an adequate level of protection, and it is for the CNPD to decide whether it does (Law No. 41/VIII/2013, art. 19). There are exceptions (art. 20): unambiguous consent of the data subject, performance of a contract or pre-contractual steps requested by the data subject, public interest or legal proceedings, protection of vital interests, and consultation of public registers. Transfers are also possible with sufficient safeguards, for example through appropriate contractual clauses.
This affects anyone who uses cloud, email, CRM or software services hosted abroad, which today is almost everyone. You need to know where the data goes and with what safeguards.
Fines and penalties
The CNPD imposes fines by resolution, and the law also provides for criminal penalties. The fines set out in Law No. 41/VIII/2013 are fixed in Cape Verdean escudos:
| Offense | Natural persons | Legal entities |
|---|---|---|
| Failing to comply, or complying improperly, with the obligation to notify the CNPD, or providing false information (art. 33) | 50,000$00 (Cape Verdean escudos) to 500,000$00 | 300,000$00 to 3,000,000$00 |
| Other offenses, such as breaching principles, data subject rights or security duties (art. 34) | 100,000$00 to 1,000,000$00 | |
The fine limits double in cases subject to prior control and for the most serious offenses (for example, special categories of data and international transfers). Negligence and attempt are punishable. These amounts come from the 2013 law, and the 2021 reform may have affected them. Confirm the amounts currently in force in the statute or with the CNPD.
- Criminal offenses. The law criminalizes unauthorized access, diversion of data, incompatible use, unlawful interconnection and the insertion of false data, with prison sentences of up to 1 or 2 years (or a fine), depending on the offense, and aggravated penalties where special categories of data are involved or harm results.
- Other consequences. Data subjects may claim compensation for damages suffered, and the CNPD may prohibit processing or issue public warnings.
- A risk that weighs more than the fine. Loss of customers and contracts, especially with European partners that require GDPR compliance, and reputational damage after a breach.
How we do it
We help you move from “are we compliant?” to a concrete plan, in six steps.
- Data mapping. We identify what personal data the organization processes, where it is, who accesses it and where it goes.
- Legal bases and notices. We verify the legal basis for each processing operation and review privacy notices, forms and consents.
- Gap analysis. We compare the current situation with the law: rights, security, processors, retention and transfers.
- Notification and authorization. We prepare the notifications or authorization requests to the CNPD, and the records of activities.
- Security and breach response. We strengthen technical controls and create a response plan that makes it possible to notify within 72 hours.
- Training and support. We train management and teams, support the data protection officer and keep track of changes in the law.
Frequently asked questions
Does my small business have to comply?
Yes. The law applies to any organization that processes personal data, regardless of size. If you have customers, employees or a form on your website, you process personal data. The effort is proportionate to the risk, but the duty to comply exists.
Do I need a data protection officer?
It is mandatory for public bodies and for anyone who, as a core activity, carries out regular and systematic monitoring of individuals on a large scale or processes special categories of data on a large scale (for example, hospitals, insurers or video surveillance companies). In other cases it is not mandatory, but designating an internal person in charge helps a great deal.
I already comply with the GDPR. Is that enough for Cabo Verde?
It helps considerably, because the 2021 reform was inspired by the GDPR. But there are important differences, such as prior notification to and authorization from the CNPD and the rules on data transfers. A specific analysis is advisable.
What should we do if we suffer a data breach?
Contain the incident, record the facts and assess the risk to individuals. If there is a risk, notify the CNPD within 72 hours and, if the risk is high, inform the data subjects. If you do not have a plan ready, it is better to have one before you need it.
How do I file a complaint with the CNPD?
Through the CNPD website (cnpd.cv), in the complaints section, or by email to cnpd@cnpd.cv. We recommend first trying to resolve the matter with the organization concerned.
Sources and legal notice
- Law No. 121/IX/2021, CNPD Cabo Verde (in Portuguese)
- Law No. 41/VIII/2013, CNPD Cabo Verde (in Portuguese)
- CNPD, O que somos e quem somos (What we are and who we are)
- CNPD, Obrigações dos responsáveis (Obligations of controllers)
- CNPD, Formulário de notificação de tratamento de dados (Data processing notification form)
- VPQ Advogados, Guia Prático do Regime Geral de Proteção de Dados em Cabo Verde (Practical Guide to the General Data Protection Regime in Cabo Verde)
- Legal MCA, Amendment of the Law on Personal Data Protection in Cape Verde
- DLA Piper, Data protection laws in Cape Verde