Data Protection Monitor
Global Privacy & Data Protection Intelligence

Mozambique Data Protection & Privacy Regulation

MZ schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: Sentinel (AML/CFT), World Payments

Last updated · 10 categories · 38 claims · 32 sources in the cumulative register

Mozambique's data-protection and cyber-governance framework moved on two fronts this cycle, with the more advanced movement occurring in adjacent cybersecurity law rather than in the core data-protection bill itself.

Data collected Data published

AI-assembled from cited sources

Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress.

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureUnregulated gap9 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityDLA PiperPrimary statutory & supervisory perimeter
Next milestone (> 2026-10-26)None scheduledNo dated future statutory milestone on record
Module coverage & confidence9 / 10 modules assessed0 Confirmed · 9 Probable · 0 Uncertain · 1 Not yet assessed

Jurisdiction brief

Latest update · 25 October 2026

Lead Signal

Mozambique's data-protection landscape remains defined by the gap between a comprehensive statute still pending before the legislature and a narrower, now-operative cybersecurity law. The Proposta de Lei de Protecção de Dados Pessoais was approved by the Council of Ministers at its 6th Ordinary Session on 3-4 March 2026 and forwarded to the Assembleia da República, where, according to the most recent status update from the National Institute of Information and Communication Technologies (INTIC), it remains on the Assembly's agenda awaiting debate, with no enactment date confirmed. The bill would create a National Personal Data Protection Authority, the Autoridade Nacional de Protecção de Dados Pessoais (ANPD), with regulatory and enforcement competence over personal-data processing, a body Mozambique currently lacks.

Key regulatory facts for Mozambique
Regulatory DimensionMozambique Standing Position
JurisdictionMozambique (MZ)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 38 sourced findings)
Regulator & FrameworkConstitutional and sectoral fragments plus an active legislative pipeline exist, but no comprehensive enacted statute or dedicated regulator is in force.
Lawful Processing & Special DataOnly a non-binding draft addresses this module; nothing is currently in force.
Data Subject RightsOnly a general constitutional principle exists; no operative rights mechanism or deadlines are in force.
Controller/Processor DutiesA narrow public-sector confidentiality duty is in force; general controller/processor obligations remain unenacted.
Primary Instruments CitedDLA Piper, Mondaq, TechHive Advisory, TechAfrica News, kabum.digital
Last Confirmed / Updated2026-11-04 (32 sources in cumulative register)

#

Constitutional and sectoral fragments plus an active legislative pipeline exist, but no comprehensive enacted statute or dedicated regulator is in force.

Traffic-light rationale — AmberConstitutional and sectoral fragments plus an active legislative pipeline exist, but no comprehensive enacted statute or dedicated regulator is in force.

Sub-modules (5)

Regulator And AuthorityRed

There is no independent dedicated data protection authority in Mozambique; oversight functions are fragmented across sectoral bodies and INTIC for ICT policy.

Claims (5):

  • Proposta de Lei de Protecção de Dados Pessoais — The draft Personal Data Protection Law designates the existing ICT regulator (INTIC) to be transformed into the independent National Authority for Personal Data Protection (ANPD) upon enactment; no such authority is currently constituted.
  • INTIC — the role of the National Authority for Protection of Personal Data (ANPD) under the draft Personal Data Protection Law
  • Proposta de Lei de Protecção de Dados Pessoais — Approved by the Council of Ministers at its 6th Ordinary Session (3-4 March 2026) and forwarded to the Assembleia da República; as of INTIC's most recent status report, it remained on the Assembly's agenda awaiting debate, with no enactment date confirmed. Would create an Autoridade Nacional de Protecção de Dados Pessoais (ANPD).
  • Mozambique — an operational dedicated data-protection authority; the draft bill proposes a two-tier CNPD (strategic) / ANPD (operational, enforcement) structure

Act And InstrumentsAmber

No comprehensive data protection act is in force. Constitutional Article 71, the Electronic Transactions Law, Law 34/2014, the Cybersecurity/Cybercrime Laws, and the pending draft Personal Data Protection Law together form the current patchwork.

Claims (10):

  • Personal Data Protection Bill — approved by the Council of Ministers in early 2026, awaiting debate before the Assembly of the Republic
  • Assembly of the Republic (Mozambique) — the Cyber Security Act and the Cybercrimes Act around 17 April 2026, establishing a National Cyber Security Council and designating INTIC as the National Cyber Security Authority
  • Article 71, Constitution of the Republic of Mozambique — Pending enactment of a comprehensive statute, data-protection coverage in Mozambique rests on Article 71 of the Constitution and scattered provisions of the Civil Code, Penal Code, Labour Law and Electronic Transactions Law (Law No. 3/2017).
  • Constitution of the Republic of Mozambique, Art. 71 — Requires the legislature to provide for the protection, access, generation and use of computerised personal data, but is not self-executing and does not itself impose operative controller/processor duties.
  • Lei n.º 3/2017 (Electronic Transactions Law), Arts 63-65 — Requires data processors to keep electronically processed personal data accurate and up to date, inform data subjects of purpose and identity before collection, adopt security measures, and designate a compliance-responsible person; Art 64 prohibits unauthorised access to or transfer of personal data between services or institutions absent legal basis or court order.

Material ScopeRed

No comprehensive material scope for 'personal data' or 'processing' has been enacted; only narrow sectoral categories (public-entity records, electronic transactions data) are addressed.

Claims (4):

  • Personal Data Protection Bill — any collection, processing, storage or use of personal data in Mozambique by public or private controllers, excluding journalism, artistic/literary purposes and purely domestic use
  • Proposta de Lei de Protecção de Dados Pessoais — As drafted, the bill's material scope covers any collection, processing, storage or use of personal data in Mozambique by public or private controllers for economic or non-private purposes, with exclusions for journalism, artistic/literary expression and certain national-security/classified material.
  • Personal Data Protection Bill — covers processing of personal data by any natural or legal person, public or private, for economic or non-private purposes within Mozambique

Territorial ScopeRed

No territorial-scope rule (e.g., extraterritorial application to non-established controllers) exists absent a comprehensive statute.

Regulator Registration And FilingRed

No controller registration or filing regime exists in the absence of a dedicated regulator.

Claims (2):

  • Electronic Transactions Law — prior notification to INTIC for processing information containing personal data
Category narrative 77 words

Mozambique has no comprehensive data protection statute and no independent dedicated data protection authority. The framework rests on Article 71 of the Constitution (general basis only), sectoral instruments (Electronic Transactions Law 3/2017; Law 34/2014 on confidentiality of personal data held by public entities), and the newly approved Cybersecurity and Cybercrime Laws (April 2026). A draft Personal Data Protection Law (sixth version released Nov 2025) was reported submitted to Parliament in March 2026 but is not yet enacted.

Periodic update · new data 2026-11-04

Regulator & Framework

Mozambique continues to operate without an operational dedicated data-protection authority or a comprehensive data-protection statute in force. The most consequential development is procedural rather than substantive: a draft Personal Data Protection Bill is understood to have been approved by the Council of Ministers in early 2026 and now awaits debate before the Assembly of the Republic. That approval is a genuine step toward enactment, though the bill has not been enacted and its formal position within the Assembly's legislative calendar - whether introduced, in committee, or scheduled for plenary debate - has not been confirmed from a primary source.

The draft bill is reported to propose a two-tier institutional structure: a strategic body, referred to in commentary as the CNPD, alongside a separate operational and enforcement body, referred to as the ANPD, which would handle day-to-day regulatory and enforcement functions once established. No such authority currently exists in operational form, so enforcement of the eventual statute would depend on this structure being stood up after enactment.

On scope, the bill is reported to extend to the processing of personal data by any natural or legal person, public or private, for economic or non-private purposes within Mozambique - a broad, GDPR-adjacent framing that would, once enacted, bring both commercial and non-commercial processing activity within a single statutory perimeter. The pinpoint article establishing this scope has not been confirmed, and the framing should be read as a reported characterisation of the draft text rather than a settled legal definition.

In the interim, data-related obligations in Mozambique remain scattered across sector-specific instruments rather than consolidated under a single regulator. The Electronic Transactions Law is reported to require prior notification to INTIC for the processing of information containing personal data - an obligation that is already in force, notwithstanding the absence of a dedicated data-protection authority to administer it. The precise article and any filing deadline attached to that notification duty have not been confirmed.

Outlook

The Assembly of the Republic's handling of the Personal Data Protection Bill is the development to watch. Until the bill clears debate and is enacted, Mozambique's data-protection landscape will remain governed by the patchwork of sectoral instruments - including the Electronic Transactions Law's INTIC notification duty - rather than by a unified statute or a standing authority with general enforcement power. Confirmation of the bill's precise legislative stage, and of whether the proposed CNPD/ANPD structure survives into any enacted version, would be the next material markers.

2 earlier distinct update(s)
Periodic update · new data 2026-10-25

Regulator & Framework

Mozambique continues to lack a comprehensive personal-data-protection statute and a dedicated supervisory authority, a position traceable to Article 71 of the Constitution of the Republic of Mozambique, which requires the legislature to provide for the protection, access, generation and use of computerised personal data but is not self-executing and imposes no operative controller or processor duty on its own. In the absence of implementing legislation, Mozambique's operative data-related obligations instead sit in sectoral instruments, principally Lei n.º 3/2017 (the Electronic Transactions Law), whose Articles 63 to 65 require data processors to keep electronically processed personal data accurate and current, to inform data subjects of the purpose and identity of the processor before collection, to adopt security measures, and to designate a person responsible for compliance; Article 64 additionally prohibits unauthorised access to, or transfer of, personal data between services or institutions absent a legal basis or court order. These sectoral duties remain in force unchanged and continue to function as the closest available analogue to a general lawful-processing regime pending comprehensive legislation.

The principal development to confirm this period concerns the status of the Proposta de Lei de Protecção de Dados Pessoais, the draft comprehensive data-protection bill. The proposal was approved by the Council of Ministers at its 6th Ordinary Session, held 3-4 March 2026, and forwarded to the Assembleia da República for legislative consideration. According to the most recent status report issued by the National Institute of Information and Communication Technologies (INTIC), the bill remains on the Assembly's agenda awaiting debate, with no enactment date confirmed. The bill, once and if enacted, would establish a National Personal Data Protection Authority, the Autoridade Nacional de Protecção de Dados Pessoais (ANPD), vested with regulatory and enforcement competence over personal-data processing, a function and institution Mozambique does not currently possess in any form. The confirmation that the bill remains pending, rather than having advanced to a floor vote or further committee stage, is itself the material development this period: it establishes, from a primary government source, that no imminent change to Mozambique's supervisory architecture should be assumed.

This prolonged pendency should be read against the structural backdrop of the constitutional mandate in Article 71, which has existed for some years without being operationalised by ordinary legislation. The pattern is one of a constitutional commitment to data protection that has not yet been given statutory and institutional form, leaving Mozambique's data-protection regime, in substance, confined to the narrower and older Electronic Transactions Law provisions. Those provisions address specific processor duties, accuracy, notice, security measures and designation of a compliance-responsible person, but do not establish a dedicated regulator, do not create a general lawful-processing framework comparable to jurisdictions with comprehensive statutes, and do not provide the data-subject-rights or enforcement architecture that the pending bill would introduce.

No further legislative movement, such as a committee report, scheduled floor debate, or indicative enactment timeline, was identified this period beyond the confirmation of continued pendency itself. The primary text of both Article 71 and the relevant provisions of Lei n.º 3/2017 was not directly retrieved; the record here rests on secondary commentary quoting them, a limitation to bear in mind when assessing the precision of the sectoral obligations described.

Outlook

The central question for Mozambique's regulatory framework remains when, and whether, the Assembleia da República will schedule a floor debate on the Proposta de Lei de Protecção de Dados Pessoais. Until that occurs and the bill is enacted, the ANPD will not come into existence, and Mozambique's data-protection landscape will continue to rest on the combination of a non-self-executing constitutional mandate and the narrower sectoral obligations of the Electronic Transactions Law. Given the bill was already approved by the Council of Ministers in March 2026 and has now spent several months before the Assembly without confirmed progress, the pace of legislative consideration itself has become a relevant indicator of how quickly Mozambique's institutional data-protection architecture is likely to materialise.

Periodic update · new data 2026-10-11

Regulator & Framework

Mozambique has no dedicated data-protection statute in force and no constituted data-protection authority as at 11 October 2026. The draft Personal Data Protection Law, formally titled the Proposta de Lei que estabelece o Regime Jurídico de Protecção de Dados Pessoais, was approved by the Council of Ministers on 4 March 2026 and forwarded to the Assembleia da República. The draft provides for the creation of a National Data Protection Authority, referred to as the ANPD, with regulatory, supervisory, and sanctioning competences, but this authority has no legal existence pending the law's enactment.

The legislative trajectory since the March 2026 Council of Ministers approval is only partially visible. Secondary reporting indicates that by 25 August 2026 the first bill text had reached parliament, with MISA Mozambique, a civil-society organisation focused on press freedom, publicly stating concern that the draft could limit fundamental citizen rights and calling for broad debate before any approval. This is understood as a statement directed at the Assembleia da República's deliberative process rather than at the executive's earlier approval. No vote outcome, committee report, or final enacted text has been identified through the close of this research cycle, and the precise status of the bill within the Assembly's legislative calendar remains unknown.

The May 2025 first-draft text, which preceded the March 2026 Council of Ministers approval, is reported to have applied to automated and non-automated collection, processing, storage, or use of personal data by public or private controllers, with exclusions for domestic use, journalism, and artistic or literary purposes. Whether these scope provisions, including the journalism exclusion that MISA's statement implicitly references, survived unchanged into the version approved in March 2026 has not been confirmed; the two draft stages are separated by roughly ten months and no side-by-side comparison of the texts was located this cycle.

The practical consequence of this prolonged draft status is that Mozambique continues to operate without an enforceable, dedicated personal-data-protection regime. Any processing activity touching Mozambican data subjects currently falls outside a comprehensive statutory framework specific to data protection, notwithstanding the existence of a constitutional privacy guarantee and various sector-specific instruments addressed elsewhere in this brief.

Outlook

The determining event for this module going forward is the Assembleia da República's handling of the bill following the acknowledged August 2026 submission of the first bill text. MISA Mozambique's public call for extended debate suggests the legislative process may proceed deliberately rather than quickly, and the eventual scope of exclusions, particularly for journalism, is a live point of civil-society attention. Until enactment, the ANPD remains a provision on paper rather than a functioning authority, and the absence of a constituted regulator means no enforcement infrastructure for a future Mozambican data-protection law currently exists.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (13)
  1. Uncertain DLA Piper — Personal Data Protection Bill — approved by the Council of Ministers in early 2026, awaiting debate before the Assembly of the Republic observed
  2. Probable Mondaq — Proposta de Lei de Protecção de Dados Pessoais — The draft Personal Data Protection Law designates the existing ICT regulator (INTIC) to be transformed into the independent National Authority for Personal Data Protection (ANPD) upon enactment; no such authority is currently constituted. observed
  3. High TechHive Advisory — INTIC — the role of the National Authority for Protection of Personal Data (ANPD) under the draft Personal Data Protection Law observed
  4. High TechAfrica News — Assembly of the Republic (Mozambique) — the Cyber Security Act and the Cybercrimes Act around 17 April 2026, establishing a National Cyber Security Council and designating INTIC as the National Cyber Security Authority observed
  5. High Mondaq — Personal Data Protection Bill — any collection, processing, storage or use of personal data in Mozambique by public or private controllers, excluding journalism, artistic/literary purposes and purely domestic use observed
  6. Probable TechHive Advisory — Article 71, Constitution of the Republic of Mozambique — Pending enactment of a comprehensive statute, data-protection coverage in Mozambique rests on Article 71 of the Constitution and scattered provisions of the Civil Code, Penal Code, Labour Law and Electronic Transactions Law (Law No. 3/2017). observed
  7. Probable DLA Piper — Proposta de Lei de Protecção de Dados Pessoais — As drafted, the bill's material scope covers any collection, processing, storage or use of personal data in Mozambique by public or private controllers for economic or non-private purposes, with exclusions for journalism, artistic/literary expression and certain national-security/classified material. observed
  8. Probable kabum.digital — Constitution of the Republic of Mozambique, Art. 71 — Requires the legislature to provide for the protection, access, generation and use of computerised personal data, but is not self-executing and does not itself impose operative controller/processor duties. observed
  9. Probable DLA Piper — Lei n.º 3/2017 (Electronic Transactions Law), Arts 63-65 — Requires data processors to keep electronically processed personal data accurate and up to date, inform data subjects of purpose and identity before collection, adopt security measures, and designate a compliance-responsible person; Art 64 prohibits unauthorised access to or transfer of personal data between services or institutions absent legal basis or court order. observed
  10. Probable INTIC (Instituto Nacional de Tecnologias de Informação e Comunicação) — Proposta de Lei de Protecção de Dados Pessoais — Approved by the Council of Ministers at its 6th Ordinary Session (3-4 March 2026) and forwarded to the Assembleia da República; as of INTIC's most recent status report, it remained on the Assembly's agenda awaiting debate, with no enactment date confirmed. Would create an Autoridade Nacional de Protecção de Dados Pessoais (ANPD). observed
  11. Probable PLMJ — Mozambique — an operational dedicated data-protection authority; the draft bill proposes a two-tier CNPD (strategic) / ANPD (operational, enforcement) structure observed
  12. Uncertain PLMJ — Personal Data Protection Bill — covers processing of personal data by any natural or legal person, public or private, for economic or non-private purposes within Mozambique observed
  13. Uncertain Mondaq — Electronic Transactions Law — prior notification to INTIC for processing information containing personal data observed

#

Only a non-binding draft addresses this module; nothing is currently in force.

Traffic-light rationale — RedOnly a non-binding draft addresses this module; nothing is currently in force.
D2 · Lawful Processing — Full Module Record4 sub-modules · 30 words · 3 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Only a general constitutional principle exists; no operative rights mechanism or deadlines are in force.

Traffic-light rationale — RedOnly a general constitutional principle exists; no operative rights mechanism or deadlines are in force.

Sub-modules (5)

Access RightRed

No enacted subject-access-request mechanism exists.

Claims (2):

  • Personal Data Protection Bill Chapter IV — a Right to Information requiring controllers to disclose their identity, the purposes of processing, and with whom data is shared

Rectification And ErasureRed

No enacted rectification/erasure right exists.

Claims indexed in baseline register · source extraction in progress

Restriction And ObjectionRed

No enacted restriction/objection right exists.

Claims indexed in baseline register · source extraction in progress

Data PortabilityRed

No enacted portability right exists.

Claims indexed in baseline register · source extraction in progress

Deadlines And Response WindowsRed

No statutory response-window requirement exists absent a comprehensive law.

Claims indexed in baseline register · source extraction in progress

Category narrative 28 words

Beyond the general constitutional guarantee in Article 71, Mozambique has no enacted framework granting enumerated data subject rights (access, rectification, erasure, restriction, objection, portability) or statutory response deadlines.

Sources and claims (1)
  1. High TechHive Advisory — Personal Data Protection Bill Chapter IV — a Right to Information requiring controllers to disclose their identity, the purposes of processing, and with whom data is shared observed

#

A narrow public-sector confidentiality duty is in force; general controller/processor obligations remain unenacted.

Traffic-light rationale — AmberA narrow public-sector confidentiality duty is in force; general controller/processor obligations remain unenacted.
D4 · Controller & Processor — Full Module Record7 sub-modules · 52 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Treaty ratification exists as a cross-border commitment, but no operative domestic transfer mechanism, adequacy status, or localisation rule has been verified.

Traffic-light rationale — AmberTreaty ratification exists as a cross-border commitment, but no operative domestic transfer mechanism, adequacy status, or localisation rule has been verified.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 48 words · 4 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Some sectoral coverage is referenced (finance, telecoms/e-transactions) but underlying instruments are not independently confirmed at statute level; other sectors show no coverage.

Traffic-light rationale — AmberSome sectoral coverage is referenced (finance, telecoms/e-transactions) but underlying instruments are not independently confirmed at statute level; other sectors show no coverage.
D6 · Sectoral Watch — Full Module Record7 sub-modules · 43 words · 1 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

No comprehensive or sectoral instrument addressing adtech/commercial privacy was located.

Traffic-light rationale — RedNo comprehensive or sectoral instrument addressing adtech/commercial privacy was located.
D7 · AdTech & Marketing — Full Module Record6 sub-modules · 22 words · 3 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Only a criminal-law privacy-intrusion offence exists; no positive algorithmic, biometric, or genetic data governance regime is in force.

Traffic-light rationale — RedOnly a criminal-law privacy-intrusion offence exists; no positive algorithmic, biometric, or genetic data governance regime is in force.
D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 45 words · 3 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

No comprehensive or sectoral instrument addressing children's or vulnerable-groups' data was located.

Traffic-light rationale — Not assessedNo comprehensive or sectoral instrument addressing children's or vulnerable-groups' data was located.

Sub-modules (5)

Age VerificationRed

No age-verification requirement identified.

Minor Profiling BansRed

No minor-profiling ban identified.

Education SettingsRed

No education-setting-specific data rule identified.

Dependent AdultsRed

No dependent-adult data protection provision identified.

Category narrative 17 words

No age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adult protection has been identified in Mozambican law.

#

No dedicated DP enforcement regime, but material legislative activity occurred within the reporting window.

Traffic-light rationale — AmberNo dedicated DP enforcement regime, but material legislative activity occurred within the reporting window.
Periodic update · new data 2026-11-04

Enforcement & Redress

Mozambique has no enacted, comprehensive enforcement regime for data-protection violations and no operational authority empowered to pursue one. The draft Personal Data Protection Bill is reported to provide for both administrative offences, classified by severity, and criminal offences, including attempted crimes - but this provision exists only within the draft text and has not been enacted into law. The specific penalty amounts or sanction bands attached to either the administrative or criminal offence categories have not been confirmed from available sourcing.

Because the bill has not cleared the Assembly of the Republic, there is currently no statutory basis for a data-protection regulator to investigate complaints, impose fines, or refer matters for criminal prosecution under a dedicated data-protection framework. Any redress available to individuals today would have to be sought through general sectoral provisions - such as those in the Electronic Transactions Law or Labour Law - rather than through a data-protection-specific enforcement mechanism, and no enforcement action under those provisions has been reported.

Outlook

The enforcement picture in Mozambique will remain effectively dormant until the Personal Data Protection Bill is enacted and an operational authority is established to administer it. Once enacted, the reported classification of offences by severity, together with the inclusion of criminal liability for attempted offences, would mark a materially more assertive enforcement posture than currently exists under any sectoral instrument. Confirmation of specific penalty levels, and of which body - the proposed CNPD, the proposed ANPD, or another authority - would hold operational enforcement power, are the open points to track as the bill progresses.

Periodic update · new data 2026-10-18

Enforcement & Redress

Mozambique's enforcement and redress landscape shifted materially this period with the entry into force, on 29 September 2026, of the country's Cybersecurity Law and Cybercrime Law. These companion instruments establish a binding legal basis for addressing cyber-related offences, a development distinct from, and ahead of, the general data-protection framework. As of the same 29 September 2026 reference date, the Personal Data Protection Bill — which would create the National Authority for Personal Data Protection (ANPD) with sanctioning power — remains on the Assembleia da República's agenda, not yet enacted.

This creates a two-track enforcement picture for Mozambique's digital-regulatory environment. On one track, cyber-offence enforcement now has a dedicated, in-force statutory basis. On the other, data-protection enforcement generally continues to rest on interim provisions under Lei n.º 3/2017, which require a data processor to answer for personal information in their possession, including information transferred to third parties, and to designate in writing a person responsible for compliance — but these interim provisions carry no dedicated regulator, sanctioning power, or formal complaints-and-redress mechanism comparable to what the pending Bill would create via the ANPD. Until the Bill advances, individuals seeking redress for data-protection harms in Mozambique lack a dedicated authority to which complaints can be directed, even as the newly in-force cyber laws provide a redress and enforcement pathway for cybercrime specifically.

No information was available this period on the precise current procedural status of the Bill beyond the 29 September 2026 reference point, nor on any enforcement action taken under the new Cybersecurity Law or Cybercrime Law.

Outlook

The principal item to watch is whether the Personal Data Protection Bill advances to enactment, which would close the gap between Mozambique's now-in-force cyber-offence enforcement architecture and its still-interim data-protection enforcement posture by creating the ANPD with sanctioning power. Until then, the asymmetry between the two tracks — cyber law in force, data-protection law pending — stands as the defining enforcement-and-redress fact for Mozambique as at 29 September 2026.

Periodic update · new data 2026-10-11

Enforcement & Redress

Mozambique has no constituted data-protection enforcement authority, and accordingly no enforcement or redress activity specific to personal-data processing was located this cycle. The most significant development in this module is not an enforcement action but a civil-society intervention into the legislative process that would eventually create such an authority. MISA Mozambique, a civil-society organisation concerned with press freedom, is understood to have publicly stated on 25 August 2026 that it fears the draft Personal Data Protection Law could limit fundamental citizen rights, and called for broad debate preceding the law's approval. The statement specifically noted that the executive had already submitted the first bill text to parliament, indicating MISA's intervention was timed to influence the Assembly's deliberative process rather than the earlier Council of Ministers approval.

This statement is significant for the enforcement-and-redress module because it concerns the future shape of the sanctioning and supervisory competences that the draft law would vest in the ANPD, the National Data Protection Authority. MISA's concern, framed around investigative journalism, implicitly raises the question of whether the draft law's exemptions, such as the journalism exclusion reported in the earlier May 2025 draft text, will survive into the enacted version, and whether the ANPD's eventual sanctioning powers could be applied in ways that affect press activity. No indication of the draft law's current position within the Assembly's legislative calendar, nor of any response from the executive or Assembly to MISA's statement, was located this cycle.

In the absence of a dedicated statute and a constituted authority, individuals in Mozambique seeking redress for personal-data misuse currently have no sector-specific regulatory complaint mechanism to resort to; any such redress would need to proceed, if at all, through general constitutional or civil-law avenues rather than through a data-protection-specific enforcement body.

Outlook

The enforcement-and-redress landscape in Mozambique will remain theoretical until the Personal Data Protection Law is enacted and the ANPD is constituted. MISA Mozambique's public intervention signals that the legislative process is subject to active civil-society scrutiny, and the eventual scope of any journalism-related exemption from the ANPD's sanctioning powers is a specific point to track as the bill proceeds through the Assembleia da República.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 71 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 38 claim(s) (38 category placement(s)), 32 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 24 Oct 2026: upheld (1 confirmed against the cited source; 15 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsdeadlines and response windows
Art. 14Data Subject Rightsdeadlines and response windows
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrestriction and objection
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacydata localisation
Art. 49Cross-Border & Adequacytransfer impact assessment
Art. 77Enforcement & Redressregulator powers and penalties
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 82Enforcement & Redressprivate right of action
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties