VPNs with servers in Mozambique

Intermediary and digital service providers that store traffic and location data must give the competent authorities access to it on request (art. 39). The law took effect 90 days after its publication on 1 July 2026 (art. 80), and the Council of Ministers must regulate it within 180 days of publication (art. 79).

Under the Cybercrime Law (Lei n.º 14/2026), in force 90 days after publication (art. 36), the judicial authority may order anyone in control of computer data, a service provider among them, to preserve it for up to three months, renewable to one year (art. 18), and to produce specified data, subscriber data included (art. 20). Whether a VPN operator is an intermediary or digital service provider under either law is not established.

Under the Cybercrime Law, the seizure of computer data authorised by the judicial authority may take the form of deleting the data or blocking access to it, and a seizure made by the criminal investigation body must be validated by a judicial authority within 72 hours (art. 22).

Posting can fall under the cyberterrorism and violent-extremism offence (art. 12, two to eight years’ imprisonment), cyber extortion by threatening to disclose compromising information (art. 13, up to two years, up to three where the victim holds public office) and child sexual content (art. 15, six months to one year and a fine).

Intercepting communications is allowed in proceedings for the offences the law creates, and for those listed in article 222 of the Code of Criminal Procedure when committed by computer system or needing electronic evidence (art. 23). The order to produce data under article 20 reaches subscriber data of providers, including foreign providers under treaties, but may not be used against suspects or defendants.

On 29 July 2026 the Constitutional Council, in Acórdão n.º 6/CC/2026, declared unconstitutional norms of the Telecommunications Traffic Control Regulation approved by Decree n.º 48/2025, published on 16 December 2025, in a case brought by the Ombudsman. The regulation had set up a regime of monitoring, data collection, suspension of services and intervention in networks.

The Council held that these measures substantially restrict freedom of expression and information, private life and the inviolability of communications, and that only a law of the Assembly of the Republic may limit those rights. The order of the rows is the security score, and a server’s location is not a recommendation.