VPNs with servers in Angola

Providers of electronic-communications services must register their users, keep communications confidential and keep stored data as protected as data on the network (art. 24). Providers of digital services, meaning internet applications run professionally on digital platforms, must keep only the technical, contractual and security records strictly necessary for the service, for preventing incidents and for legal duties (art. 16). Both must register with the National Cybersecurity Centre.

Failing to register is a serious administrative offence, fined from 100 to 250 national minimum wages for an individual and from 300 to 500 for a company (arts. 55–56). The duty to identify or register users is not a general civil identification of all users (art. 16(4)). Whether a VPN operator is an electronic-communications or digital-service provider under the Law is not established.

Law 9/26 contains no provision on blocking sites or removing content. Where a system is compromised by a cyberattack, the response teams may recommend or order, by reasoned and recorded decision, a temporary limit on using the system or its strictly necessary components, but not access to the content of private communications without judicial authorisation (art. 47(4)–(5)).

The Press Law (Law 1/17 of 23 January 2017) applies the limits it sets on press freedom to content disseminated over the internet, wherever the server hosting the site is located (art. 7). A media company or outlet that breaches its editorial statute faces suspension for three to nine months, and cancellation on a repeat (art. 29). Restrictions on what may be said online also come from the Penal Code, set out below.

The Penal Code (Law 38/20 of 11 November 2020) punishes insult (art. 213) with up to six months or a fine of up to 60 days, defamation (art. 214) with up to one year or 120 days, and slander, an imputation known to be false (art. 215), with six months to two years. Where the ground is race, ethnicity, sex, sexual orientation, belief or political conviction, the penalties for insult and defamation are higher.

Offences committed through an information system carry penalties raised by half (art. 216). Illegitimate access to an information system is punished with up to two years, or two to eight years where security rules were breached (art. 438). Interference by public authorities in private correspondence and communications is permitted only by a competent judicial decision (Law 9/26, art. 5).

Law 9/26 declares the secrecy of correspondence and other private communications inviolable and allows public authorities to interfere only by a competent judicial decision (art. 5). Information handed to the response teams is confidential and may not be used for other purposes than prevention, response, supervision or a lawful proceeding (art. 47(3)), and the Law does not prejudice the powers of the judicial and criminal-investigation authorities (art. 49).

The order of the rows is the security score, and a server’s location is not a recommendation.