Processes personal data, in Guyana

Data Protection Act 2023 (Act No. 18 of 2023), not yet commenced · Read the law's page

• A data controller must comply, for all the personal data it processes, with the data protection principles in section 4(1) of the Data Protection Act 2023: process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes; keep it adequate, accurate and identifiable for no longer than necessary; and process it with appropriate security.
• Process personal data only where a lawful basis in section 6(1) applies, such as the data subject's consent for specific purposes, performance of a contract, a legal obligation, vital interests or legitimate interests, and be able to demonstrate consent where processing rests on it.
• Register in the Register of Data Controllers before operating as a data controller, nominate a representative established in Guyana if you are not established there, and register as a data processor before operating as one (sections 51 and 57).
• Keep a record of processing activities, apply appropriate technical and organizational security measures, designate a data protection officer where section 69 requires one, and carry out an impact assessment before processing likely to result in a high risk (sections 62, 64, 67 and 69).

Data Protection Act 2023, ss. 11-18 and 20-22 (rights of data subjects) · Read the law's page

• Once the Data Protection Act 2023 is commenced, tell a data subject on request whether you process their personal data, give them the description section 11 lists and a copy, and provide it in electronic form where the request is electronic.
• Rectify inaccurate personal data and erase personal data without undue delay where a section 13(2) ground applies, such as withdrawal of consent, and tell each recipient of a rectification, erasure or restriction unless that is impossible or involves disproportionate effort.
• Restrict processing on a section 14 ground, give a data subject the personal data they provided in a structured, commonly used and machine-readable format, and transmit it to another controller where processing is by automated means on consent or contract.
• Stop processing personal data for direct marketing when the data subject objects, and cease or do not begin processing that the data subject requires in writing you to stop because it is causing or likely to cause substantial, unwarranted damage or distress.
• Give a data subject at collection, or within one month where the data came from another source, the information sections 20 and 21 list, including your identity, the purposes and legal basis, the recipients, the retention period, their rights and the right to complain to the Commissioner.
• Answer a data subject's rights request without undue delay and within one month of receipt, extend that period by two months only for complex or numerous requests and tell the data subject of the extension and the reasons within the first month, and provide the response free of charge.

Data Protection Act 2023, ss. 23-30 (transfers outside Guyana) · Read the law's page

• Once the Data Protection Act 2023 is commenced, do not transfer personal data to a country, territory or international organization outside Guyana unless it provides an adequate level of protection and appropriate safeguards under which the data subject's rights are enforceable and effective legal remedies are available.
• Base a transfer on a section 25 safeguard, such as binding corporate rules authorized by the Commissioner, standard data protection clauses the Commissioner prescribes, or contractual clauses the Commissioner authorizes.
• Rely on a section 28 derogation, such as the data subject's consent or necessity for a contract, only where it applies, and where you rely on the compelling-legitimate-interests derogation in section 28(2), inform the Commissioner and the data subject of the transfer.
• Do not give effect to a foreign court judgment or administrative decision requiring you to transfer or disclose personal data unless it is based on an international agreement between the requesting country and Guyana.

Data Protection Act 2023, ss. 4(10), 72-73, 78-85 and 97-99 (the Commissioner, enforcement, compensation and penalties) · Read the law's page

• Once the Data Protection Act 2023 is commenced, comply with an enforcement notice, information notice or special information notice the Commissioner serves, and make no statement you know to be false, or recklessly make one that is false, in answering an information notice.
• Compensate a person who suffers damage or distress from your contravention of the Act, unless you show that you took all measures reasonably required to comply.
• Do not knowingly or recklessly obtain or disclose personal data, or procure its disclosure, without the data controller's consent, and do not sell or offer to sell personal data obtained that way, unless a section 98(2) defense applies.
• Comply with the notification of register changes, records of processing, security, breach notification, impact assessment, prior consultation and data protection officer duties in sections 53(1), 59(1) and 62 to 69, which the Commissioner may enforce, after a hearing, by an administrative penalty of up to ten million dollars.

Data Protection Act 2023, ss. 65-66 (notification and communication of a personal data breach) · Read the law's page

• Once the Data Protection Act 2023 is commenced, notify the Commissioner of a personal data breach without undue delay and, where feasible, within seventy-two hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of any person, and give reasons for any delay beyond seventy-two hours.
• As a data processor, notify the data controller without undue delay after becoming aware of a personal data breach.
• Describe in the notification the nature of the breach, the categories and approximate number of data subjects and records concerned, a contact point, the likely consequences and the measures taken or proposed, and document every breach with its facts, effects and remedial action.
• Communicate a breach likely to result in a high risk to the rights and freedoms of persons to the data subject, in clear and plain language, without undue delay and where feasible within seventy-two hours of becoming aware of it, unless encryption or later measures remove the risk or direct communication would take disproportionate effort, in which case communicate publicly.

Data Protection Act 2023, ss. 8-9 (child's consent and sensitive personal data) · Read the law's page

• Once the Data Protection Act 2023 is commenced, do not process sensitive personal data, which includes genetic data, biometric data, health records, financial and criminal records and data on racial or ethnic origin, political opinions, religious beliefs, trade-union membership or sexual life, unless the data subject consents or another ground in section 9(1) applies.
• Process a child's personal data only where the child's parent or guardian gives or authorizes consent, and make reasonable efforts, taking available technology into account, to verify that consent.