Duty LXD-0884
Processes personal data, in Belize
Data Protection Act 2021, comprehensive regimefrom a date not yet set5 lines
Data Protection Act, 2021 (Act No. 45 of 2021), ss. 2-22 · Read the law's page
- Before processing personal data of a person in Belize, establish a lawful basis such as consent, a contract with the data subject, or a legal obligation, and process it fairly, transparently, and only for the specified purpose.
- Do not process sensitive personal data, including biometric data such as a voiceprint or faceprint, unless a listed condition applies, such as the data subject's consent or a deliberate act by the data subject making the information public.
- Give a data subject access to, and the ability to correct, erase, restrict, or port, their personal data on request.
- Do not base a decision solely on automated processing, including profiling, that produces a legal or similarly significant effect on a person, unless a contract, an authorising enactment with safeguards, or the person's consent applies, and never for sensitive personal data outside the public interest.
- Stop processing a person's personal data for direct marketing once they object.
Data Protection Act 2021, cross-border transfer of personal datafrom a date not yet set2 lines
Data Protection Act, 2021 (Act No. 45 of 2021), ss. 23-29 (Transfers of Personal Data outside of Belize) · Read the law's page
- Before transferring personal data of a person in Belize outside the country, confirm the destination has an adequate level of protection or put an appropriate safeguard in place, such as standard contractual clauses or binding corporate rules.
- This condition does not apply to a transfer made for the purpose of cloud storage.
Data Protection Act 2021, personal data breach notificationfrom a date not yet set2 lines
Data Protection Act, 2021 (Act No. 45 of 2021), ss. 60-62 · Read the law's page
- Where feasible, notify the Data Protection Commissioner of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to risk a person's rights and freedoms.
- Where a personal data breach is likely to result in a high risk to a person's rights and freedoms, notify that person without undue delay and, where feasible, not later than 70 hours after becoming aware of it.
Data Protection Act 2021, Commissioner, Tribunal, and enforcementfrom a date not yet set2 lines
Data Protection Act, 2021 (Act No. 45 of 2021), ss. 68-92 · Read the law's page
- Comply with an Enforcement Notice, Information Notice, or Special Information Notice the Data Protection Commissioner issues, or answer to the Data Protection Tribunal on appeal.
- An individual harmed by a contravention of the Act may claim compensation from the data controller or processor responsible.