Processes personal data, in Grenada

Data Protection Act, No. 1 of 2023, s. 21 (sensitive personal data) · Read the law's page

• Do not process sensitive personal data, including health, genetic, biometric, sex life, political or religious information, except on one of the Act's listed grounds, ordinarily the data subject's written consent.
• Where you rely on a ground other than consent, confirm it is one the Act lists: an employment right or obligation, protecting the data subject's or another person's interests where consent cannot reasonably be obtained, medical purposes handled under a duty of confidentiality, legal proceedings or advice, the administration of justice, a government function, or information the data subject has already made public.

Data Protection Act, No. 1 of 2023, ss. 1, 3-7, 9-12, 14, 20 and 22-23 (scope, principles, disclosure restriction and exemptions) · Read the law's page

• Establish a lawful basis, ordinarily the data subject's consent, before processing personal data about them, or rely on one of the Act's specific alternative grounds such as contractual necessity, a legal obligation, or a statutory or government function.
• Process personal data only for a lawful purpose directly related to your activity, and hold no more than is adequate and not excessive for that purpose.
• Do not disclose personal data for a new purpose or to a new class of recipient without the data subject's consent, unless the disclosure prevents or detects crime, is authorised by an enactment or court order, or the Minister deems it justified as being in the public interest.
• Take practical steps to secure personal data against loss, misuse, unauthorised access, alteration or destruction, and obtain a data processor's own security guarantees before letting it process personal data on your behalf.
• Do not retain personal data longer than necessary for the purpose it was processed for, and take reasonable steps to keep it accurate, complete and up to date.
• Establish formal procedures implementing these principles, and review them, with a self-assessment, at least once every five years.

Data Protection Act, No. 1 of 2023, ss. 24-47 (Information Commission, enforcement, civil remedies and offences) · Read the law's page

• Cooperate with an Information Commission investigation, complaint, information notice or warrant, and furnish the access, documentation and security information it requests.
• Comply with an enforcement notice within the time it specifies, and where compliance materially modifies personal data, notify the data subject and anyone the data was disclosed to in the twelve months before the notice.
• Do not obstruct the Commission or an authorised officer in the conduct of their duties.
• Do not dismiss, suspend, demote, discipline, harass or otherwise disadvantage an employee because they reported, or refused to take part in, a contravention of the Act in good faith.
• Do not intentionally disclose personal information in contravention of the Act, and do not collect, store or dispose of personal information in a manner that contravenes the Act (s. 39).

Data Protection Act, No. 1 of 2023, ss. 8, 13 and 15-19 (rights of data subjects) · Read the law's page

• Give the data subject notice of the purpose and source of collection, their access and rectification rights, the classes of third party the data may be disclosed to, and whether supplying the data is obligatory, when they request it.
• Give a data subject access to, and let them rectify, their personal data on written request, unless a refusal ground under the Act applies.
• Confirm within thirty days of a written access request, accompanied by the prescribed processing fee, whether access will be given, and if so give access within sixty days, subject to an extension of up to thirty more days in narrow circumstances.
• State the specific ground for any refusal of access in the written notice, together with the data subject's right to complain to the Commission about the refusal.
• Let a data subject examine their personal data or give them a copy, providing it in an alternative format where they have a sensory disability.
• Amend personal data on a data subject's application where it is incomplete, incorrect, misleading, excessive, or irrelevant to the purpose it is held for.