Angola: Cloud in Oil and Gas

The Ministry is the regulatory and oversight body responsible for regulating oil exploration and production activities.¹¹

The key regulator for the O&G industry is now the ANPG¹². This agency is not only the regulator but also the national concessionaire¹³, being entrusted also with the tasks of supervising and fostering the implementation of the oil activities, namely, all public procurement and operations.

ANPG has assumed the function of national concessionaire¹⁴ and regulates, supervises and promotes the implementation of oil activities in the field of operations and contracting of the oil, gas and biofuels sector. The purpose of the restructure is to ensure greater political coordination, eliminate eventual conflicts of interest, increase the transparency and efficiency of the processes and create attractive conditions for private investment in the national oil industry¹⁵.

Sonangol, E.P. is now the public oil company¹⁶.

Legislation has also been published in the Official Gazette foreseeing the creation of the Oil Derivatives’ Regulatory Institute¹⁷.

Cloud services are permitted. There is no specific regulation on cloud services in Angola. There may however be laws of application to the Angolan O&G industry, which may need to be considered. In making the decision to move to the cloud, it is crucial for industry participants to consider and ensure compliance with all applicable legislation.

Microsoft is proud to confirm that it meets regulatory and compliance requirements for use of the cloud in some of the most highly regulated industries across the globe and can help you to achieve compliance with the regulatory and compliance requirements applicable in the O&G sector

There is presently no uniform regulation of cloud services in Angola. Role-players within the O&G industry should however be mindful of certain regulatory provisions in moving to the cloud, namely:

• Data and information collected during prospecting is the property of the Angolan State. The Ministry may, however, authorise the licensee to sell the data and information collected, after consulting with the concessionaire (ANPG). The profits related to the sale are shared equally between the concessionaire and the licensee.¹⁸
• Confidentiality of technical and economic data must be maintained by the Ministry and by all other people and entities involved in O&G operations until the expiry date foreseen in the relevant license or concession agreement.¹⁹
• Furthermore, the Production Sharing Agreement (PSA) provides that all information of a technical nature obtained throughout petroleum operations belong to the concessionaire. Thus, the licensee is only entitled to use and copy, free of charge, such information for internal purposes.
• Unless otherwise agreed by the concessionaire and the licensee, while the PSA remains in force, all technical, economic, accounting or any other information, including, without limitation, reports, maps, logs, records and other data developed through the conduct of petroleum operations, must be held strictly confidential and must not be disclosed by the licensee without the concessionaire's prior written consent. However, permitted exceptions allow the O&G companies to disclose the aforementioned data in certain circumstances, without such consent, to consultants, contractors or other third parties as may be necessary in connection with petroleum operations upon obtaining a similar undertaking of confidentiality.
• The PSA also provides that the licensee's obligation to keep information obtained during the petroleum operations confidential continue for 10 years after the PSA terminates (or any other period agreed by the concessionaire and the licensee).

In addition, there may also be licence and/or contractual provisions (including confidentiality undertakings for each concession, in Joint Operating Agreements) which may need to be considered.

Microsoft acknowledges the customer as the exclusive owner of its data, and provides both strong contractual undertakings as well as technical and operational measures to address confidentiality and security.

Approval is not required from any O&G regulator, as none of the O&G sector legislation specifically addresses cloud services. However, modifications to the O&G legislation may be implemented in the future by ANPG²⁰.

An O&G industry participant which is an organ of state (such as the ANPG) may be required to follow specific procurement processes in procuring cloud services under applicable public procurement laws. This may necessitate certain approvals, but any such requirement is unlikely to relate specifically to the aspect of cloud computing.

O&G regulators possess broad inspection powers that include the power to search and seize a wide range of information and records²¹. Microsoft’s cloud services are subject to rigorous audits by internationally accredited third parties and are certified against several key global standards and regulatory requirements. Those standards include ISO/IEC 27001²² and 27002 as well as the cloud specific extension ISO/IEC 27017²³ and ISO/IEC 27018²⁴ (a series of the most well-known globally accepted information security management standards) and the Service Organization Controls standards SOC1, SOC2 and SOC3²⁵ as well as the Cloud Security Alliance’s Security, Trust & Assurance Registry (CSA STAR)²⁶. Together, the advanced controls embodied within these global standards allow Microsoft to meet or exceed local information security requirements that may apply.

There are no data transfer requirements specifically for the O&G sector, but Law No. 22/2011 ("Data Protection Law"), of 17 June, regulates the transfer of personal information and provides that the communication of data to a sub-contracted data processor can only be carried out if the following conditions are complied with²⁷: (a) the subcontractor and the data controller must enter into a written agreement or other legally valid written document, under which terms the subcontractor undertakes to comply with the provisions of the Data Protection Law and to act according to the instructions of the data controller; and (b) notification to the Angolan data protection ²⁸. These rules only apply to any information with respect to any natural person (individual), but do not apply to companies.

The data controller may only transfer personal data to a third party outside Angola after notifying the Angolan data protection authority and if the country has a level of protection at least identical to that provided by the Data Protection Law²⁹. Otherwise, the transfer of personal data to a third party outside Angola has to be authorized by the Angolan data protection authority, and such authorization may only be granted when the specific circumstances set out in the Data Protection Law are complied with³⁰.

Microsoft holds itself accountable to and is subject to laws of general application applicable to information technology service providers, and has binding agreements which, in its view, are likely to constitute adequate protection. In addition, Microsoft adheres to the EU Model Clauses as well as the EU Privacy Shield and the ISO 27018 Privacy Standard. Microsoft is also committed to ensuring that its products and services comply with the EU General Data Protection Regulation (GDPR) which came into force in May 2018.