Data protection & privacy laws in Mozambique (2026)

In the absence of a comprehensive law, privacy obligations derive from the Constitution (right to privacy), Civil Code, Penal Code, Labour Law, Credit Institutions Law, Consumer Law, and Law No. 3/2017 on Electronic Transactions. Article 64 of Law 3/2017 prohibits unauthorised access to or transfer of personal data between computer files of different institutions.

Decree No. 66/2019 (Regulation for the Security of Telecommunication Networks) requires operators to implement technical measures to protect network infrastructure and data, complementing the Electronic Transactions Law's cybersecurity obligations.

INTIC launched a public consultation on 5 September 2025 and convened with the Council of Europe on 7 October 2025 to align the draft with international standards. The Council of Ministers approved the Proposta de Lei in March 2026; it was then submitted to the Assembly of the Republic for final adoption.

The bill is modelled on the EU GDPR, the Council of Europe's Convention 108+, and the African Union Malabo Convention on Cybersecurity and Personal Data Protection. It is also aligned with regional precedents including South Africa's POPIA and Angola's Law 22/11.

The bill provides for the creation of the Autoridade Nacional de Proteção de Dados (ANPD), an independent public institution with administrative and financial autonomy, responsible for issuing regulations, supervising compliance, investigating complaints, and imposing administrative sanctions. No such dedicated authority exists yet.

The bill establishes principles of consent, lawfulness, purpose limitation, data minimisation, accuracy, transparency, confidentiality, and proportionality. It applies to any natural or legal person — public or private — processing personal data for economic or non-private purposes in Mozambique, with enforcement via tiered administrative penalties.