Angola Personal Data Protection Law (Law No. 22/11)

Angola

v2011

19 domains

23 controls

Angola's Law No. 22/11 on the Protection of Personal Data (2011) establishes the country's data protection framework. The Agência de Protecção de Dados (APD) serves as the supervisory authority. The law establishes data processing principles, individual rights, controller obligations, and provisions for cross-border transfers. Applies to processing of personal data by controllers established in Angola.

Verified

Angola Personal Data Protection Law (Law No. 22/11) is a compliance framework from Angola with 19 domains and 23 controls that map to 7 other frameworks. The largest domains are Rights (3 controls), Security (2 controls), Special Categories (2 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (19)

Awareness

1 controls

Controls in the Awareness domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-23	Training and Awareness	Personnel processing personal data must receive training on Law 22/11 obligations.

CCTV

1 controls

Controls in the CCTV domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-14	Video Surveillance and Location Data	Use of CCTV and location data is subject to proportionality, signage, retention limits and APD notification or authorisa...

Documentation

1 controls

Controls in the Documentation domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-19	Records of Processing	Maintain documented records of processing activities to demonstrate compliance to the APD.

Enforcement

1 controls

Controls in the Enforcement domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-20	APD Cooperation and Audits	Cooperate with APD inspections, provide requested information and implement corrective measures.

Incident Response

1 controls

Controls in the Incident Response domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-18	Breach Response	Controllers must respond to personal data breaches and may be required to notify the APD and affected individuals.

Legal Basis

1 controls

Controls in the Legal Basis domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-3	Lawful Basis	Processing requires consent or another lawful basis such as contractual necessity, legal obligation, vital interest, pub...

Marketing

1 controls

Controls in the Marketing domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-15	Direct Marketing and Cookies	Direct marketing requires consent with a clear opt-out mechanism; electronic tracking technologies require informed cons...

Principles

1 controls

Controls in the Principles domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-2	General Processing Principles	Processing must be lawful, transparent, for specified and legitimate purposes, accurate, proportionate, and retained onl...

Processors

1 controls

Controls in the Processors domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-12	Processor Agreements	Engagement of processors requires a written contract specifying purposes, instructions, security and confidentiality.

Registration

1 controls

Controls in the Registration domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-5	APD Notification and Authorisation	Processing operations must be notified to the Data Protection Agency (APD); certain categories require prior authorisati...

Rights

3 controls

Controls in the Rights domain of Angola Personal Data Protection Law (Law No. 22/11) — 3 controls
Code	Title	Description
AO-PDPL-7	Right of Access	Data subjects have a right to obtain confirmation, copy and information on the processing of their data.
AO-PDPL-8	Right of Rectification, Erasure and Blocking	Data subjects may have inaccurate data corrected, excessive or unlawful data erased or blocked.
AO-PDPL-9	Right to Object	Data subjects can object to processing including direct marketing and to decisions based on automated processing.

Sanctions

1 controls

Controls in the Sanctions domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-21	Sanctions and Liability	Violations may result in administrative fines, criminal penalties and civil liability for damages.

Scope

1 controls

Controls in the Scope domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-1	Scope and Application	The law applies to processing of personal data in Angola or by controllers using means located in Angola.

Sectoral

1 controls

Controls in the Sectoral domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-22	Sectoral Rules Health and Financial	Processing of health, financial and telecommunications data is subject to sector-specific rules and supervisory oversigh...

Security

2 controls

Controls in the Security domain of Angola Personal Data Protection Law (Law No. 22/11) — 2 controls
Code	Title	Description
AO-PDPL-10	Security Measures	Controllers and processors must implement technical and organisational security measures appropriate to the risk.
AO-PDPL-11	Confidentiality Obligations	Persons processing personal data are bound by confidentiality obligations that survive employment.

Special Categories

2 controls

Controls in the Special Categories domain of Angola Personal Data Protection Law (Law No. 22/11) — 2 controls
Code	Title	Description
AO-PDPL-17	Children's Data	Processing of minors' data requires consent of the legal representative and age-appropriate safeguards.
AO-PDPL-4	Sensitive Data	Processing of sensitive data (philosophical, political beliefs, party affiliation, religion, private life, ethnicity, he...

Transfers

1 controls

Controls in the Transfers domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-13	Cross-Border Transfers	Transfers outside Angola require APD authorisation unless the recipient country provides adequate protection or specific...

Transparency

1 controls

Controls in the Transparency domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-6	Information to Data Subjects	Data subjects must be informed at collection of the controller, purposes, recipients, retention and their rights.

Workplace

1 controls

Controls in the Workplace domain of Angola Personal Data Protection Law (Law No. 22/11) — 1 controls
Code	Title	Description
AO-PDPL-16	Employee Monitoring	Employer monitoring of employee communications and activity is restricted, requires notice, proportionality and APD auth...

Your Compliance Coverage

If you comply with Angola Personal Data Protection Law (Law No. 22/11), you already cover:

GDPR

65%

15 controls mapped

Compare →

ISO 37001:2016

1 controls mapped

Compare →

ISO 27018

1 controls mapped

Compare →

+ 4 more: ISO/IEC 27018:2019 (4%), ISO 19011 (4%)

See all 7 mapped frameworks ↓

Maps to 7 other frameworks

23 total controls

GDPR

15 source controls mapped|19 target controls covered

65%

ISO 37001:2016