Law No. 7/17, concerning the Protection of Networks and Information Systems (LPNIS) was recently published in the Official Gazette, which imposes a set of new obligations to several players in the Angola market. Electronic communication undertakings, information society service providers, primary storage service providers, critical infrastructure service providers (e.g., entities responsible for supply chains, health, security and utilities), as well as entities providing critical social functions (financial sector, transportation, Oil&Gas) are now subject to obligations in what concerns information and information systems protection and security, storage of data, data retention for investigation purposes, cooperation with the competent authority and interception of communications, depending on the scope of activity carried out.

LEGAL FRAMEWORK

Similarly to legislative acts on the security of networks and storage of data within pertaining to electronic communications in force in other countries and/or regions, as is the case in the European Union, this law aims at responding to the new challenges posed by the information society, particularly fostering the protection of the Angolan cyberspace against cyber attacks, which are becoming more frequent, and easing the use of information in the digitalspace for purposes of criminal investigation.

Among the main obligations set out in the LPNIS, we highlight the following:

The Agency for the Protection of Personal Data is the entity responsible for pursuing contravention proceedings as well as for assessing the respective fines. It should be stressed, however, that this Agency, albeit created by Law nr. 22/11 of 17 June – Personal Data Protection Law-, is not functioning yet. This law also foresees a Computer Incident Monitoring and Response Team, which organization and functioning shall be established in a separate act, not published to date.

IMPACTS OF THE LPNIS

the fostering of security of the cyberspace in Angola