--- title: "Mozambique Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/mozambique/ source_html: /jurisdictions/mozambique/index.html description: "Mozambique data protection and privacy regulation: 10 categories, 38 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: 542f1800457d0a1c5685b3c9410512117104bbf6f4612b8e333f27497b3adf3d generator: "fe-fleet/md-twin@1.0" --- # Mozambique Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/mozambique/), [World Payments](https://payments.gi/jurisdictions/mozambique/) Last updated 2026-11-04 · 10 categories · 38 claims · 32 sources in the cumulative register Download report (PDF) Expand all Mozambique's data-protection and cyber-governance framework moved on two fronts this cycle, with the more advanced movement occurring in adjacent cybersecurity law rather than in the core data-protection bill itself. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress. Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=MOZAMBIQUE)[Build Report](/reports/?j=MOZAMBIQUE)[Compare](/compare/?j=MOZAMBIQUE) Framework posture Unregulated gap 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority DLA Piper Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed 10 Categories 4 Red categories 57 Sub-modules 38 Claims 1 Tier-1 sources Traffic-light mix 5 amber 4 red 1 n/a (sums to 10 rendered categories; click to filter) 4 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 986 Full executive summary 469 ###### Latest update · 25 October 2026 #### Lead Signal Mozambique's data-protection landscape remains defined by the gap between a comprehensive statute still pending before the legislature and a narrower, now-operative cybersecurity law. The Proposta de Lei de Protecção de Dados Pessoais was approved by the Council of Ministers at its 6th Ordinary Session on 3-4 March 2026 and forwarded to the Assembleia da República, where, according to the most recent status update from the National Institute of Information and Communication Technologies (INTIC), it remains on the Assembly's agenda awaiting debate, with no enactment date confirmed. The bill would create a National Personal Data Protection Authority, the Autoridade Nacional de Protecção de Dados Pessoais (ANPD), with regulatory and enforcement competence over personal-data processing, a body Mozambique currently lacks. Separately, Lei n.º 13/2026, Mozambique's new Cybersecurity Law, entered into force on 29 September 2026, having been approved by the Assembly on 29 April 2026, promulgated on 10 June 2026, and published in the Boletim da República on 1 July 2026. The law applies broadly across Public Administration, the private sector, critical-infrastructure network operators, intermediary and digital-service providers, electronic-communications operators and digital-platform operators, requiring cybersecurity risk-management measures and establishing prevention, detection and response mechanisms. It is a security-and-resilience instrument rather than a personal-data-specific statute, but its scope reaches organisations that also process personal data, so it now provides a partial, interim layer of security obligation in the continued absence of the pending data-protection law. #### Other Developments Cybersecurity Law creates a cross-border data-preservation and refusal mechanism. Lei n.º 13/2026 permits a foreign authority to request expedited preservation of computer data stored in Mozambican territory in support of a mutual-legal-assistance request. Mozambique may refuse subsequent execution of such a request where the requesting state lacks adequate personal-data-protection guarantees, where dual criminality is not met, or where execution would prejudice sovereignty, security, public order or other constitutionally protected interests. This provision is notable for a jurisdiction without a comprehensive data-protection statute of its own, since it ties a cross-border cooperation mechanism to an adequacy-style assessment of the requesting state's data-protection guarantees, even though Mozambique's own domestic framework for such guarantees is still in draft form. #### Cross-Monitor Connections The pending data-protection bill and the newly in-force Cybersecurity Law both touch on obligations that overlap with financial-sector compliance architecture tracked under financial-integrity, particularly around data security and cross-border data-preservation mechanisms tied to mutual legal assistance; readers tracking financial-crime cooperation channels for Mozambique may find the Cybersecurity Law's data-preservation and refusal provisions relevant context, though this record does not re-analyse that domain. No crypto-specific or payments-specific development is identified in this record. #### Outlook The central indicator to watch remains whether the Assembleia da República schedules and holds a floor debate on the Proposta de Lei de Protecção de Dados Pessoais; as at the most recent INTIC status report, no enactment date had been confirmed. Until the bill is enacted and the ANPD becomes operational, Mozambique will continue to rely on a patchwork of sectoral and constitutional provisions, now supplemented by the Cybersecurity Law's security-and-incident-response requirements, rather than a unified personal-data-protection regime with a dedicated enforcement authority. 2 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Mozambique's data-protection and cyber-governance framework moved on two fronts this cycle, with the more advanced movement occurring in adjacent cybersecurity law rather than in the core data-protection bill itself. The Assembly of the Republic approved the Cyber Security Act and the Cybercrimes Act around 17 April 2026, establishing a National Cyber Security Council and designating INTIC as the National Cyber Security Authority. This is a high-confidence finding corroborated across two independent T3 sources, and it is now in force. The substantive Personal Data Protection Bill, by contrast, remains pending: it was approved by the Council of Ministers in early 2026 and forwarded to the Assembly of the Republic for debate, but has not itself been enacted. The result is a transitional state in which enforceable cyber-governance authority now exists ahead of the comprehensive data-protection regime that would eventually govern lawful processing, data subject rights, and cross-border transfers. #### Other Developments INTIC positioned for a dual regulatory role. Under the draft Personal Data Protection Bill, INTIC is designated to assume the role of the National Authority for Protection of Personal Data (ANPD), a proposed rather than enacted designation. INTIC's parallel, already-in-force role as National Cyber Security Authority under the Cyber Security Act means the same institution is positioned as the eventual anchor for both cyber-governance and data-protection oversight in Mozambique, pending the Bill's enactment. Escalating administrative sanctions proposed for the future ANPD. The draft Bill would empower the ANPD with escalating administrative sanctions ranging from warnings to fines, blocking or deletion of data, and partial or total prohibition of processing activities, subject to a fair administrative process. These powers exist only in bill form; the ANPD is not yet operational and INTIC's current enforcement authority runs through the Cyber Security and Cybercrimes Acts rather than a data-protection-specific rulebook. #### Cross-Monitor Connections The Cyber Security Act and Cybercrimes Act, and the pending Personal Data Protection Bill's cross-border transfer-authorisation requirement, carry direct relevance to the financial-integrity monitor, which has separately flagged the draft Bill's AML/KYC data-sharing implications for obliged entities in its own regulatory-horizon tracking. The world-payments monitor's coverage of Mozambique's National Financial Inclusion Strategy, which foresees future data-protection and cybersecurity obligations for banks, is a related forward-looking thread that will intersect with INTIC's eventual ANPD role once the Bill is enacted. #### Outlook The principal item to watch is whether the Assembly of the Republic debates and enacts the Personal Data Protection Bill, which per its own terms would trigger implementing regulations within 180 days of publication. Until enactment, INTIC's operative authority runs through the Cyber Security Act and Cybercrimes Act rather than a data-protection-specific mandate, and the ANPD's proposed sanctions powers remain non-binding. Read full brief · 986 words ###### Latest update · 4 November 2026 #### Regulatory Status Mozambique has no comprehensive data-protection statute in force and no operational dedicated data-protection authority. A draft Personal Data Protection Bill is reported to have been approved by the Council of Ministers in early 2026 and now awaits debate before the Assembly of the Republic; it proposes a two-tier CNPD/ANPD structure and would, once enacted, cover processing by any person, public or private, for economic or non-private purposes. In the interim, obligations remain sectoral: the Electronic Transactions Law requires prior notification to INTIC for processing personal data, and the Labour Law requires employee consent before an employer transfers employee data to third parties. The draft bill is also reported to provide for administrative offences classified by severity and criminal offences, including attempted crimes, but none of this has been enacted. #### Outlook The path of the Personal Data Protection Bill through the Assembly of the Republic is the central development to track. Until enactment, Mozambique's data-protection landscape will remain governed by sectoral instruments rather than a unified statute or standing authority, with no dedicated enforcement mechanism in operation. ###### Standing brief · as of 25 October 2026 #### Regulatory Status Mozambique does not yet have a comprehensive personal-data-protection statute in force. Article 71 of the Constitution mandates future legislation on the protection, access, generation and use of computerised personal data but is not self-executing. The Proposta de Lei de Protecção de Dados Pessoais, approved by the Council of Ministers on 3-4 March 2026 and forwarded to the Assembleia da República, remains pending before the Assembly, with no enactment date confirmed as at the most recent government status update; it would establish a National Personal Data Protection Authority (ANPD) once enacted. In the interim, operative obligations rest on sectoral provisions, chiefly Lei n.º 3/2017 (Electronic Transactions Law) Articles 63-65, covering data accuracy, notice, security measures and designation of a compliance-responsible person. A material addition to the security layer arrived with Lei n.º 13/2026, the Cybersecurity Law, which entered into force on 29 September 2026 after Assembly approval on 29 April 2026 and publication on 1 July 2026. It imposes cybersecurity risk-management and incident-response obligations across a broad range of public and private operators, and separately creates a cross-border computer-data-preservation mechanism for mutual-legal-assistance requests, subject to a refusal ground tied to the requesting state's personal-data-protection guarantees. #### Outlook The central indicator for Mozambique's data-protection trajectory is whether and when the Assembleia da República schedules a floor debate on the pending data-protection bill. Until enactment, Mozambique's framework will continue to combine a non-self-executing constitutional mandate, narrower sectoral duties under the Electronic Transactions Law, and the newly in-force Cybersecurity Law's risk-management and cross-border data-preservation provisions, rather than a unified regime with a dedicated enforcement authority. Read full brief · 469 words Key regulatory facts for Mozambique Regulatory Dimension Mozambique Standing Position Jurisdiction Mozambique (MZ) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 38 sourced findings) Regulator & Framework Constitutional and sectoral fragments plus an active legislative pipeline exist, but no comprehensive enacted statute or dedicated regulator is in force. Lawful Processing & Special Data Only a non-binding draft addresses this module; nothing is currently in force. Data Subject Rights Only a general constitutional principle exists; no operative rights mechanism or deadlines are in force. Controller/Processor Duties A narrow public-sector confidentiality duty is in force; general controller/processor obligations remain unenacted. Primary Instruments Cited DLA Piper, Mondaq, TechHive Advisory, TechAfrica News, kabum.digital Last Confirmed / Updated 2026-11-04 (32 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Mozambique: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Constitutional and sectoral fragments plus an active legislative pipeline exist, but no comprehensive enacted statute or dedicated regulator is in force. Traffic-light rationale — Amber Constitutional and sectoral fragments plus an active legislative pipeline exist, but no comprehensive enacted statute or dedicated regulator is in force. #### Sub-modules (5) #### Regulator And AuthorityRed There is no independent dedicated data protection authority in Mozambique; oversight functions are fragmented across sectoral bodies and INTIC for ICT policy. Claims (5): - Proposta de Lei de Protecção de Dados Pessoais — The draft Personal Data Protection Law designates the existing ICT regulator (INTIC) to be transformed into the independent National Authority for Personal Data Protection (ANPD) upon enactment; no such authority is currently constituted. - INTIC — the role of the National Authority for Protection of Personal Data (ANPD) under the draft Personal Data Protection Law - Proposta de Lei de Protecção de Dados Pessoais — Approved by the Council of Ministers at its 6th Ordinary Session (3-4 March 2026) and forwarded to the Assembleia da República; as of INTIC's most recent status report, it remained on the Assembly's agenda awaiting debate, with no enactment date confirmed. Would create an Autoridade Nacional de Protecção de Dados Pessoais (ANPD). - Mozambique — an operational dedicated data-protection authority; the draft bill proposes a two-tier CNPD (strategic) / ANPD (operational, enforcement) structure #### Act And InstrumentsAmber No comprehensive data protection act is in force. Constitutional Article 71, the Electronic Transactions Law, Law 34/2014, the Cybersecurity/Cybercrime Laws, and the pending draft Personal Data Protection Law together form the current patchwork. Claims (10): - Personal Data Protection Bill — approved by the Council of Ministers in early 2026, awaiting debate before the Assembly of the Republic - Assembly of the Republic (Mozambique) — the Cyber Security Act and the Cybercrimes Act around 17 April 2026, establishing a National Cyber Security Council and designating INTIC as the National Cyber Security Authority - Article 71, Constitution of the Republic of Mozambique — Pending enactment of a comprehensive statute, data-protection coverage in Mozambique rests on Article 71 of the Constitution and scattered provisions of the Civil Code, Penal Code, Labour Law and Electronic Transactions Law (Law No. 3/2017). - Constitution of the Republic of Mozambique, Art. 71 — Requires the legislature to provide for the protection, access, generation and use of computerised personal data, but is not self-executing and does not itself impose operative controller/processor duties. - Lei n.º 3/2017 (Electronic Transactions Law), Arts 63-65 — Requires data processors to keep electronically processed personal data accurate and up to date, inform data subjects of purpose and identity before collection, adopt security measures, and designate a compliance-responsible person; Art 64 prohibits unauthorised access to or transfer of personal data between services or institutions absent legal basis or court order. #### Material ScopeRed No comprehensive material scope for 'personal data' or 'processing' has been enacted; only narrow sectoral categories (public-entity records, electronic transactions data) are addressed. Claims (4): - Personal Data Protection Bill — any collection, processing, storage or use of personal data in Mozambique by public or private controllers, excluding journalism, artistic/literary purposes and purely domestic use - Proposta de Lei de Protecção de Dados Pessoais — As drafted, the bill's material scope covers any collection, processing, storage or use of personal data in Mozambique by public or private controllers for economic or non-private purposes, with exclusions for journalism, artistic/literary expression and certain national-security/classified material. - Personal Data Protection Bill — covers processing of personal data by any natural or legal person, public or private, for economic or non-private purposes within Mozambique #### Territorial ScopeRed No territorial-scope rule (e.g., extraterritorial application to non-established controllers) exists absent a comprehensive statute. #### Regulator Registration And FilingRed No controller registration or filing regime exists in the absence of a dedicated regulator. Claims (2): - Electronic Transactions Law — prior notification to INTIC for processing information containing personal data Mozambique has no comprehensive data protection statute and no independent dedicated data protection authority. The framework rests on Article 71 of the Constitution (general basis only), sectoral instruments (Electronic Transactions Law 3/2017; Law 34/2014 on confidentiality of personal data held by public entities), and the newly approved Cybersecurity and Cybercrime Laws (April 2026). A draft Personal Data Protection Law (sixth version released Nov 2025) was reported submitted to Parliament in March 2026 but is not yet enacted. Periodic update · new data 2026-11-04 #### Regulator & Framework Mozambique continues to operate without an operational dedicated data-protection authority or a comprehensive data-protection statute in force. The most consequential development is procedural rather than substantive: a draft Personal Data Protection Bill is understood to have been approved by the Council of Ministers in early 2026 and now awaits debate before the Assembly of the Republic. That approval is a genuine step toward enactment, though the bill has not been enacted and its formal position within the Assembly's legislative calendar - whether introduced, in committee, or scheduled for plenary debate - has not been confirmed from a primary source. The draft bill is reported to propose a two-tier institutional structure: a strategic body, referred to in commentary as the CNPD, alongside a separate operational and enforcement body, referred to as the ANPD, which would handle day-to-day regulatory and enforcement functions once established. No such authority currently exists in operational form, so enforcement of the eventual statute would depend on this structure being stood up after enactment. On scope, the bill is reported to extend to the processing of personal data by any natural or legal person, public or private, for economic or non-private purposes within Mozambique - a broad, GDPR-adjacent framing that would, once enacted, bring both commercial and non-commercial processing activity within a single statutory perimeter. The pinpoint article establishing this scope has not been confirmed, and the framing should be read as a reported characterisation of the draft text rather than a settled legal definition. In the interim, data-related obligations in Mozambique remain scattered across sector-specific instruments rather than consolidated under a single regulator. The Electronic Transactions Law is reported to require prior notification to INTIC for the processing of information containing personal data - an obligation that is already in force, notwithstanding the absence of a dedicated data-protection authority to administer it. The precise article and any filing deadline attached to that notification duty have not been confirmed. #### Outlook The Assembly of the Republic's handling of the Personal Data Protection Bill is the development to watch. Until the bill clears debate and is enacted, Mozambique's data-protection landscape will remain governed by the patchwork of sectoral instruments - including the Electronic Transactions Law's INTIC notification duty - rather than by a unified statute or a standing authority with general enforcement power. Confirmation of the bill's precise legislative stage, and of whether the proposed CNPD/ANPD structure survives into any enacted version, would be the next material markers. 2 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework Mozambique continues to lack a comprehensive personal-data-protection statute and a dedicated supervisory authority, a position traceable to Article 71 of the Constitution of the Republic of Mozambique, which requires the legislature to provide for the protection, access, generation and use of computerised personal data but is not self-executing and imposes no operative controller or processor duty on its own. In the absence of implementing legislation, Mozambique's operative data-related obligations instead sit in sectoral instruments, principally Lei n.º 3/2017 (the Electronic Transactions Law), whose Articles 63 to 65 require data processors to keep electronically processed personal data accurate and current, to inform data subjects of the purpose and identity of the processor before collection, to adopt security measures, and to designate a person responsible for compliance; Article 64 additionally prohibits unauthorised access to, or transfer of, personal data between services or institutions absent a legal basis or court order. These sectoral duties remain in force unchanged and continue to function as the closest available analogue to a general lawful-processing regime pending comprehensive legislation. The principal development to confirm this period concerns the status of the Proposta de Lei de Protecção de Dados Pessoais, the draft comprehensive data-protection bill. The proposal was approved by the Council of Ministers at its 6th Ordinary Session, held 3-4 March 2026, and forwarded to the Assembleia da República for legislative consideration. According to the most recent status report issued by the National Institute of Information and Communication Technologies (INTIC), the bill remains on the Assembly's agenda awaiting debate, with no enactment date confirmed. The bill, once and if enacted, would establish a National Personal Data Protection Authority, the Autoridade Nacional de Protecção de Dados Pessoais (ANPD), vested with regulatory and enforcement competence over personal-data processing, a function and institution Mozambique does not currently possess in any form. The confirmation that the bill remains pending, rather than having advanced to a floor vote or further committee stage, is itself the material development this period: it establishes, from a primary government source, that no imminent change to Mozambique's supervisory architecture should be assumed. This prolonged pendency should be read against the structural backdrop of the constitutional mandate in Article 71, which has existed for some years without being operationalised by ordinary legislation. The pattern is one of a constitutional commitment to data protection that has not yet been given statutory and institutional form, leaving Mozambique's data-protection regime, in substance, confined to the narrower and older Electronic Transactions Law provisions. Those provisions address specific processor duties, accuracy, notice, security measures and designation of a compliance-responsible person, but do not establish a dedicated regulator, do not create a general lawful-processing framework comparable to jurisdictions with comprehensive statutes, and do not provide the data-subject-rights or enforcement architecture that the pending bill would introduce. No further legislative movement, such as a committee report, scheduled floor debate, or indicative enactment timeline, was identified this period beyond the confirmation of continued pendency itself. The primary text of both Article 71 and the relevant provisions of Lei n.º 3/2017 was not directly retrieved; the record here rests on secondary commentary quoting them, a limitation to bear in mind when assessing the precision of the sectoral obligations described. #### Outlook The central question for Mozambique's regulatory framework remains when, and whether, the Assembleia da República will schedule a floor debate on the Proposta de Lei de Protecção de Dados Pessoais. Until that occurs and the bill is enacted, the ANPD will not come into existence, and Mozambique's data-protection landscape will continue to rest on the combination of a non-self-executing constitutional mandate and the narrower sectoral obligations of the Electronic Transactions Law. Given the bill was already approved by the Council of Ministers in March 2026 and has now spent several months before the Assembly without confirmed progress, the pace of legislative consideration itself has become a relevant indicator of how quickly Mozambique's institutional data-protection architecture is likely to materialise. Periodic update · new data 2026-10-11 #### Regulator & Framework Mozambique has no dedicated data-protection statute in force and no constituted data-protection authority as at 11 October 2026. The draft Personal Data Protection Law, formally titled the Proposta de Lei que estabelece o Regime Jurídico de Protecção de Dados Pessoais, was approved by the Council of Ministers on 4 March 2026 and forwarded to the Assembleia da República. The draft provides for the creation of a National Data Protection Authority, referred to as the ANPD, with regulatory, supervisory, and sanctioning competences, but this authority has no legal existence pending the law's enactment. The legislative trajectory since the March 2026 Council of Ministers approval is only partially visible. Secondary reporting indicates that by 25 August 2026 the first bill text had reached parliament, with MISA Mozambique, a civil-society organisation focused on press freedom, publicly stating concern that the draft could limit fundamental citizen rights and calling for broad debate before any approval. This is understood as a statement directed at the Assembleia da República's deliberative process rather than at the executive's earlier approval. No vote outcome, committee report, or final enacted text has been identified through the close of this research cycle, and the precise status of the bill within the Assembly's legislative calendar remains unknown. The May 2025 first-draft text, which preceded the March 2026 Council of Ministers approval, is reported to have applied to automated and non-automated collection, processing, storage, or use of personal data by public or private controllers, with exclusions for domestic use, journalism, and artistic or literary purposes. Whether these scope provisions, including the journalism exclusion that MISA's statement implicitly references, survived unchanged into the version approved in March 2026 has not been confirmed; the two draft stages are separated by roughly ten months and no side-by-side comparison of the texts was located this cycle. The practical consequence of this prolonged draft status is that Mozambique continues to operate without an enforceable, dedicated personal-data-protection regime. Any processing activity touching Mozambican data subjects currently falls outside a comprehensive statutory framework specific to data protection, notwithstanding the existence of a constitutional privacy guarantee and various sector-specific instruments addressed elsewhere in this brief. #### Outlook The determining event for this module going forward is the Assembleia da República's handling of the bill following the acknowledged August 2026 submission of the first bill text. MISA Mozambique's public call for extended debate suggests the legislative process may proceed deliberately rather than quickly, and the eventual scope of exclusions, particularly for journalism, is a live point of civil-society attention. Until enactment, the ANPD remains a provision on paper rather than a functioning authority, and the absence of a constituted regulator means no enforcement infrastructure for a future Mozambican data-protection law currently exists. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (13) - [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=law&c=MZ) — Personal Data Protection Bill — approved by the Council of Ministers in early 2026, awaiting debate before the Assembly of the Republic - [Mondaq](https://www.mondaq.com/privacy-protection/1702808/mozambique-personal-data-protection-bill) — Proposta de Lei de Protecção de Dados Pessoais — The draft Personal Data Protection Law designates the existing ICT regulator (INTIC) to be transformed into the independent National Authority for Personal Data Protection (ANPD) upon enactment; no such authority is currently constituted. - [TechHive Advisory](https://www.techhiveadvisory.africa/insights/review-of-mozambiques-proposed-personal-data-protection-law) — INTIC — the role of the National Authority for Protection of Personal Data (ANPD) under the draft Personal Data Protection Law - [TechAfrica News](https://techafricanews.com/2026/04/17/mozambique-parliament-approves-cybersecurity-and-cybercrime-laws-to-strengthen-digital-governance/) — Assembly of the Republic (Mozambique) — the Cyber Security Act and the Cybercrimes Act around 17 April 2026, establishing a National Cyber Security Council and designating INTIC as the National Cyber Security Authority - [Mondaq](https://www.mondaq.com/privacy-protection/1702808/mozambique-personal-data-protection-bill) — Personal Data Protection Bill — any collection, processing, storage or use of personal data in Mozambique by public or private controllers, excluding journalism, artistic/literary purposes and purely domestic use - [TechHive Advisory](https://www.techhiveadvisory.africa/insights/review-of-mozambiques-proposed-personal-data-protection-law) — Article 71, Constitution of the Republic of Mozambique — Pending enactment of a comprehensive statute, data-protection coverage in Mozambique rests on Article 71 of the Constitution and scattered provisions of the Civil Code, Penal Code, Labour Law and Electronic Transactions Law (Law No. 3/2017). - [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=law&c=MZ) — Proposta de Lei de Protecção de Dados Pessoais — As drafted, the bill's material scope covers any collection, processing, storage or use of personal data in Mozambique by public or private controllers for economic or non-private purposes, with exclusions for journalism, artistic/literary expression and certain national-security/classified material. - [kabum.digital](https://kabum.digital/proteccao-dados-pessoais-mocambique-2026/) — Constitution of the Republic of Mozambique, Art. 71 — Requires the legislature to provide for the protection, access, generation and use of computerised personal data, but is not self-executing and does not itself impose operative controller/processor duties. - [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=law&c=MZ) — Lei n.º 3/2017 (Electronic Transactions Law), Arts 63-65 — Requires data processors to keep electronically processed personal data accurate and up to date, inform data subjects of purpose and identity before collection, adopt security measures, and designate a compliance-responsible person; Art 64 prohibits unauthorised access to or transfer of personal data between services or institutions absent legal basis or court order. - [INTIC (Instituto Nacional de Tecnologias de Informação e Comunicação)](https://intic.gov.mz/mocambique-apresenta-avancos-no-combate-ao-cibercrime-na-conferencia-octopus-2026/) — Proposta de Lei de Protecção de Dados Pessoais — Approved by the Council of Ministers at its 6th Ordinary Session (3-4 March 2026) and forwarded to the Assembleia da República; as of INTIC's most recent status report, it remained on the Assembly's agenda awaiting debate, with no enactment date confirmed. Would create an Autoridade Nacional de Protecção de Dados Pessoais (ANPD). - [PLMJ](https://www.plmj.com/en/knowledge/informative-notes/Mozambique-Personal-Data-Protection-Bill/34166/) — Mozambique — an operational dedicated data-protection authority; the draft bill proposes a two-tier CNPD (strategic) / ANPD (operational, enforcement) structure - [PLMJ](https://www.plmj.com/en/knowledge/informative-notes/Mozambique-Personal-Data-Protection-Bill/34166/) — Personal Data Protection Bill — covers processing of personal data by any natural or legal person, public or private, for economic or non-private purposes within Mozambique - [Mondaq](https://www.mondaq.com/privacy-protection/1702808/mozambique-personal-data-protection-bill) — Electronic Transactions Law — prior notification to INTIC for processing information containing personal data ### Mozambique: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only a non-binding draft addresses this module; nothing is currently in force. Traffic-light rationale — Red Only a non-binding draft addresses this module; nothing is currently in force. D2 · Lawful Processing — Full Module Record 4 sub-modules · 30 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mozambique: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only a general constitutional principle exists; no operative rights mechanism or deadlines are in force. Traffic-light rationale — Red Only a general constitutional principle exists; no operative rights mechanism or deadlines are in force. #### Sub-modules (5) #### Access RightRed No enacted subject-access-request mechanism exists. Claims (2): - Personal Data Protection Bill Chapter IV — a Right to Information requiring controllers to disclose their identity, the purposes of processing, and with whom data is shared #### Rectification And ErasureRed No enacted rectification/erasure right exists. Claims indexed in baseline register · source extraction in progress #### Restriction And ObjectionRed No enacted restriction/objection right exists. Claims indexed in baseline register · source extraction in progress #### Data PortabilityRed No enacted portability right exists. Claims indexed in baseline register · source extraction in progress #### Deadlines And Response WindowsRed No statutory response-window requirement exists absent a comprehensive law. Claims indexed in baseline register · source extraction in progress Beyond the general constitutional guarantee in Article 71, Mozambique has no enacted framework granting enumerated data subject rights (access, rectification, erasure, restriction, objection, portability) or statutory response deadlines. Sources and claims (1) - [TechHive Advisory](https://www.techhiveadvisory.africa/insights/review-of-mozambiques-proposed-personal-data-protection-law) — Personal Data Protection Bill Chapter IV — a Right to Information requiring controllers to disclose their identity, the purposes of processing, and with whom data is shared ### Mozambique: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A narrow public-sector confidentiality duty is in force; general controller/processor obligations remain unenacted. Traffic-light rationale — Amber A narrow public-sector confidentiality duty is in force; general controller/processor obligations remain unenacted. D4 · Controller & Processor — Full Module Record 7 sub-modules · 52 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mozambique: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Treaty ratification exists as a cross-border commitment, but no operative domestic transfer mechanism, adequacy status, or localisation rule has been verified. Traffic-light rationale — Amber Treaty ratification exists as a cross-border commitment, but no operative domestic transfer mechanism, adequacy status, or localisation rule has been verified. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 48 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mozambique: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Some sectoral coverage is referenced (finance, telecoms/e-transactions) but underlying instruments are not independently confirmed at statute level; other sectors show no coverage. Traffic-light rationale — Amber Some sectoral coverage is referenced (finance, telecoms/e-transactions) but underlying instruments are not independently confirmed at statute level; other sectors show no coverage. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 43 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mozambique: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No comprehensive or sectoral instrument addressing adtech/commercial privacy was located. Traffic-light rationale — Red No comprehensive or sectoral instrument addressing adtech/commercial privacy was located. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 22 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mozambique: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only a criminal-law privacy-intrusion offence exists; no positive algorithmic, biometric, or genetic data governance regime is in force. Traffic-light rationale — Red Only a criminal-law privacy-intrusion offence exists; no positive algorithmic, biometric, or genetic data governance regime is in force. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 45 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Mozambique: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No comprehensive or sectoral instrument addressing children's or vulnerable-groups' data was located. Traffic-light rationale — Not assessed No comprehensive or sectoral instrument addressing children's or vulnerable-groups' data was located. #### Sub-modules (5) #### Age VerificationRed No age-verification requirement identified. #### Parental ConsentRed No parental-consent mechanism identified. #### Minor Profiling BansRed No minor-profiling ban identified. #### Education SettingsRed No education-setting-specific data rule identified. #### Dependent AdultsRed No dependent-adult data protection provision identified. No age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adult protection has been identified in Mozambican law. ### Mozambique: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ No dedicated DP enforcement regime, but material legislative activity occurred within the reporting window. Traffic-light rationale — Amber No dedicated DP enforcement regime, but material legislative activity occurred within the reporting window. Periodic update · new data 2026-11-04 #### Enforcement & Redress Mozambique has no enacted, comprehensive enforcement regime for data-protection violations and no operational authority empowered to pursue one. The draft Personal Data Protection Bill is reported to provide for both administrative offences, classified by severity, and criminal offences, including attempted crimes - but this provision exists only within the draft text and has not been enacted into law. The specific penalty amounts or sanction bands attached to either the administrative or criminal offence categories have not been confirmed from available sourcing. Because the bill has not cleared the Assembly of the Republic, there is currently no statutory basis for a data-protection regulator to investigate complaints, impose fines, or refer matters for criminal prosecution under a dedicated data-protection framework. Any redress available to individuals today would have to be sought through general sectoral provisions - such as those in the Electronic Transactions Law or Labour Law - rather than through a data-protection-specific enforcement mechanism, and no enforcement action under those provisions has been reported. #### Outlook The enforcement picture in Mozambique will remain effectively dormant until the Personal Data Protection Bill is enacted and an operational authority is established to administer it. Once enacted, the reported classification of offences by severity, together with the inclusion of criminal liability for attempted offences, would mark a materially more assertive enforcement posture than currently exists under any sectoral instrument. Confirmation of specific penalty levels, and of which body - the proposed CNPD, the proposed ANPD, or another authority - would hold operational enforcement power, are the open points to track as the bill progresses. Periodic update · new data 2026-10-18 #### Enforcement & Redress Mozambique's enforcement and redress landscape shifted materially this period with the entry into force, on 29 September 2026, of the country's Cybersecurity Law and Cybercrime Law. These companion instruments establish a binding legal basis for addressing cyber-related offences, a development distinct from, and ahead of, the general data-protection framework. As of the same 29 September 2026 reference date, the Personal Data Protection Bill — which would create the National Authority for Personal Data Protection (ANPD) with sanctioning power — remains on the Assembleia da República's agenda, not yet enacted. This creates a two-track enforcement picture for Mozambique's digital-regulatory environment. On one track, cyber-offence enforcement now has a dedicated, in-force statutory basis. On the other, data-protection enforcement generally continues to rest on interim provisions under Lei n.º 3/2017, which require a data processor to answer for personal information in their possession, including information transferred to third parties, and to designate in writing a person responsible for compliance — but these interim provisions carry no dedicated regulator, sanctioning power, or formal complaints-and-redress mechanism comparable to what the pending Bill would create via the ANPD. Until the Bill advances, individuals seeking redress for data-protection harms in Mozambique lack a dedicated authority to which complaints can be directed, even as the newly in-force cyber laws provide a redress and enforcement pathway for cybercrime specifically. No information was available this period on the precise current procedural status of the Bill beyond the 29 September 2026 reference point, nor on any enforcement action taken under the new Cybersecurity Law or Cybercrime Law. #### Outlook The principal item to watch is whether the Personal Data Protection Bill advances to enactment, which would close the gap between Mozambique's now-in-force cyber-offence enforcement architecture and its still-interim data-protection enforcement posture by creating the ANPD with sanctioning power. Until then, the asymmetry between the two tracks — cyber law in force, data-protection law pending — stands as the defining enforcement-and-redress fact for Mozambique as at 29 September 2026. Periodic update · new data 2026-10-11 #### Enforcement & Redress Mozambique has no constituted data-protection enforcement authority, and accordingly no enforcement or redress activity specific to personal-data processing was located this cycle. The most significant development in this module is not an enforcement action but a civil-society intervention into the legislative process that would eventually create such an authority. MISA Mozambique, a civil-society organisation concerned with press freedom, is understood to have publicly stated on 25 August 2026 that it fears the draft Personal Data Protection Law could limit fundamental citizen rights, and called for broad debate preceding the law's approval. The statement specifically noted that the executive had already submitted the first bill text to parliament, indicating MISA's intervention was timed to influence the Assembly's deliberative process rather than the earlier Council of Ministers approval. This statement is significant for the enforcement-and-redress module because it concerns the future shape of the sanctioning and supervisory competences that the draft law would vest in the ANPD, the National Data Protection Authority. MISA's concern, framed around investigative journalism, implicitly raises the question of whether the draft law's exemptions, such as the journalism exclusion reported in the earlier May 2025 draft text, will survive into the enacted version, and whether the ANPD's eventual sanctioning powers could be applied in ways that affect press activity. No indication of the draft law's current position within the Assembly's legislative calendar, nor of any response from the executive or Assembly to MISA's statement, was located this cycle. In the absence of a dedicated statute and a constituted authority, individuals in Mozambique seeking redress for personal-data misuse currently have no sector-specific regulatory complaint mechanism to resort to; any such redress would need to proceed, if at all, through general constitutional or civil-law avenues rather than through a data-protection-specific enforcement body. #### Outlook The enforcement-and-redress landscape in Mozambique will remain theoretical until the Personal Data Protection Law is enacted and the ANPD is constituted. MISA Mozambique's public intervention signals that the legislative process is subject to active civil-society scrutiny, and the eventual scope of any journalism-related exemption from the ANPD's sanctioning powers is a specific point to track as the bill proceeds through the Assembleia da República. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 71 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties