In an increasingly digitalised world, the adoption of clear legal frameworks to regulate each advancement in technology is ever so pertinent. Although cloud services, as we know them, have been around for over 20 years, Mozambique´s move to formally regulate this sector represents a significant milestone in aligning the country with international technological and regulatory trends.
The Regulation establishes the framework for the registration, licensing, development, procurement, hosting and operation of cloud computing services and it applies to all cloud computing service providers operating in Mozambique, regardless of whether they are established within Mozambican territory or not. With the exception of the following:
- Services provided between companies within the same group of companies where the provision of cloud computing services is not the main activity of the respective provider;
- Services provided between companies within the same group of companies where the provision of cloud computing services, being their main activity, is provided solely to companies within their group;
- Cloud computing services in the testing phase, which are not yet marketed, except when applied to real production environments.
It is important to note that though the above are not obligated to comply with the Regulation with regards to its registration, licensing and operation, the same are subject to the technical security rules and data protection requirements, as well as potential administrative sanctions for non-compliance.
The Regulation designates INTIC - Instituto Nacional de Tecnologias de Informação e Comunicação (National Institute of Information and Communication Technologies), as the competent regulatory authority responsible for registration, licensing, and supervision of cloud computing services.
A key innovation is the introduction of a fully digital regulatory process, managed through the Portal do Operador Económico de Novas Tecnologias (New Technologies Economic Operator Portal). All procedures, communications, and compliance obligations must be handled electronically through this platform.
Moreover, this Regulation establishes strict rules regarding the handling of sensitive and classified information, as well as the guidelines for the implementation of security measures.
Lastly, it is important to note that providers already operating in Mozambique at the time of entry into force of the Regulation are granted a one-year transition period to comply with the new regulatory requirements.
The information contained in this publication does not constitute a definitive opinion and is not intended to constitute legal or professional advice and should not be used as the basis for taking a definitive position of CGA.
This content is copyright of Couto, Graça e Associados
