Cybersecurity regulation in Angola (2026)

Law No. 7/17 of 16 February 2017 establishes legal protections for networks and computer systems and requires electronic communications operators to implement preventive security measures to ensure network integrity and reliability. It is the primary in-force cybersecurity statute.

Law No. 22/11 of 17 June 2011 (LPDP), enforced by the Agência de Protecção de Dados (APD), requires data controllers to notify the APD of personal data breaches. A revised draft data-protection law underwent public consultation from March–April 2025 and awaits enactment.

Operators of critical information infrastructure are obliged under existing law to report cyber incidents to the Cybersecurity Incident Alert and Response Center (CARIC). A National Cybersecurity Incident Management Framework introduced by the Ministry of Telecommunications in 2024 formalises coordination among Angola-CSIRT, APD, INACOM, and the CRO.

On 23 January 2026 the Angolan parliament approved a standalone Cybersecurity Bill in its first reading (105 in favour, 1 against, 75 abstentions). The bill would create a National Cybersecurity Centre (CNC) as the central regulatory and sanctioning authority overseeing the entire national cybersecurity system; further readings are required before final enactment.

Presidential Decree No. 256/25 approved Angola's National Cybersecurity Strategy and Presidential Decree No. 258/25 of 3 December 2025 established the National Cybersecurity Council and its Regulation, providing a strategic coordination framework in advance of the pending comprehensive legislation.

The Angola Computer Security Incident Response Team (Angola-CSIRT) was informally launched in late 2023 to coordinate national cyber-incident responses, intelligence sharing, and public advisories alongside INACOM and the APD, providing an operational incident-response capability ahead of formal legislative backing.