Law: There is no general data protection law.

Regulator: There is no general data protection authority.

Summary: Mozambique has not yet enacted a comprehensive data protection law. However, the legal framework concerning data protection can be found within various pieces of sectoral legislation and the Constitution of the Republic of Mozambique (the Constitution). Particularly, Article 71 of the Constitution establishes that the law shall provide for general protection of personal data in computer records, the requirements for access to databases, and the terms of use by public and private authorities of these databases or computer media.

The Electronic Transactions Law (Law no. 03/2017, dated January 9, 2017) contains provisions relevant to e-commerce and electronic transactions. These provisions have implications for data protection and privacy in the context of digital business activities. Furthermore, the financial and telecommunications sectors have established their own distinct legal frameworks with the primary objective of regulating and safeguarding data within their respective industries.

Law no. 34/2014, enacted on December 31, 2014, classifies personal data held by public entities as confidential. Sharing this data without explicit consent or a court order is prohibited. Violating these rules can result in fines and possible criminal prosecution. Additionally, under the Mozambican Penal Code (Law no. 24/2019 of December 24, 2019), Article 252 prohibits unauthorized interference with people's privacy, including intercepting communications, capturing images, or sharing private information, which is punishable by up to one year in prison and a corresponding fine.

Mozambique signed the African Union Convention on Cyber Security and Personal Data Protection (the AU Convention) on June 26, 2018, and subsequently ratified the Convention on January 21, 2020.

Notably, in November 2022, the Instituto Nacional de Tecnologias de Informação (INTIC) proposed a new Cybersecurity Law, which includes references to personal data protection.