Data protection in Cape Verde: what the law says

Cape Verde has had a general personal data protection regime since 2001. The regime has since been amended twice and is aligned with Convention 108 of the Council of Europe, to which the country has been a Party since 1 October 2018. This guide explains, in general terms, which laws apply, who oversees compliance, and what rights data subjects have.

The applicable laws

The general regime for the protection of personal data of natural persons was established by Law 133/V/2001, of 22 January (Official Gazette 2, Series I, of 22 January 2001), and was amended by Law 41/VIII/2013, of 17 September, and by Law 121/IX/2021, of 17 March (the second amendment).

The preamble of Law 121/IX/2021 identifies the regime’s direct source: the 1998 Portuguese data protection law (Law 67/98), which transposed the European Directive 95/46/EC of that era. In other words, the Cape Verdean model followed the European data protection standard of the early 2000s, not the EU’s GDPR, which dates from 2016. The 2021 amendment brought the regime closer to the modern Convention 108+ of the Council of Europe.

Personal data protection has a constitutional root in Cape Verde: Law 133/V/2001 rests on article 44 of the 1992 Constitution, which guarantees everyone access to computerised data concerning them and the right to rectify it and to know the purpose of its processing.

Scope of application

The regime applies to the processing of personal data carried out wholly or partly by automated means, as well as to manual files, and expressly includes video surveillance. It also reaches controllers established outside the national territory who use means located in Cape Verde; the 2021 amendment extended this dimension to controllers established abroad who process data of persons present in Cape Verde.

Concepts updated by Law 121/IX/2021

The second amendment introduced or clarified concepts the 2001 regime did not know, notably:

• the pseudonymisation of data;
• biometric data and data concerning health;
• the concept of a personal data breach;
• profiling, with the prohibition of profiling that leads to discrimination and of subjecting persons to significant decisions based solely on profiling.

The same law clarified the conditions of valid consent, setting 16 years as the minimum age for a data subject’s valid consent, with the intervention of legal representatives where it is absent.

Rights of data subjects

The core of the data subject’s rights has constitutional and statutory roots: to know the data concerning them and the purpose of the processing, to access the data and to require its rectification. The 2021 amendment reinforced these rights with the anti-discrimination profiling protections noted above. The channels for exercising these rights, the forms and the authority’s guidance are available on the CNPD site.

Important note: rights typical of more recent regimes, such as portability of data between providers, are not part of the verified Cape Verdean regime; this guide asserts no more than the law provides.

The National Data Protection Commission (CNPD)

The Cape Verdean data protection authority is the Comissão Nacional de Protecção de Dados (CNPD), an independent administrative entity working alongside the National Assembly, seated in the city of Praia, under the Statute approved by Law 42/VIII/2013, of 17 September (official CNPD site).

Among the CNPD’s powers:

• monitoring and supervising compliance with the legal and regulatory provisions on personal data protection;
• investigative and inquiry powers;
• authority powers, including ordering the blocking, erasure or destruction of data and prohibiting, temporarily or definitively, processing operations, including on open networks from servers located in Cape Verdean territory;
• issuing prior opinions and, in cases of repeated non-compliance, publicly warning or censuring the controller.

Law 120/IX/2021, of 17 March, reinforced the authority: the CNPD acquired public-law legal personality, authority powers, and administrative and financial autonomy, and may impose fines and ancillary sanctions, issue general directives and promote awareness; it is composed of three personalities, including the president, elected by the National Assembly by a two-thirds majority.

General obligations of controllers

The regime imposes, among others, the following obligations on those who process personal data: process data lawfully, on the basis of the data subject’s consent or other legal grounds; guarantee data quality (accuracy and updating where necessary); collect only the data necessary for the declared purposes; and ensure the security of processing. Law 121/IX/2021 added the duty of security appropriate to processing involving biometric or health data and the management of personal data breaches.

Good practices for citizens

• Exercise the rights of access and rectification directly with the controller and, if necessary, with the CNPD;
• read the privacy policies of the services you use: they must identify the purposes and the legal basis of the processing;
• the site you are reading this guide on publishes its own privacy policy, with the concrete framing of the processing it carries out.

About this page

This guide is informational and does not constitute legal advice. The text was verified on 8 October 2026 against the legislation published in the Electronic Official Gazette and against the CNPD site. Cape Verde has signed the African Union convention on cybersecurity and data protection (Malabo); its instrument of ratification could not be located in the Official Gazette as of the last verification, so this guide does not assert its internal effect. For a concrete case, consult a lawyer enrolled in the Bar Association of Cape Verde.