Processes personal data, in Kiribati

Data Protection Act 2025, s. 12 (consent for children and individuals lacking capacity) · Read the law's page

• Obtain consent from a parent, guardian, or other appropriate legal representative before relying on the consent of a data subject who is under eighteen or otherwise lacks legal capacity, wherever the Act requires the data subject's consent for a lawful basis, retention, an automated decision, or a cross-border transfer.
• Obtain that same consent from a parent, guardian, or other appropriate legal representative before relying on a data subject's voluntary provision of personal data as a lawful basis, where the data subject is under eighteen or otherwise lacks legal capacity.
• Let a parent, guardian, or other appropriate legal representative exercise a data subject's rights or lodge a complaint on behalf of a data subject who is under eighteen or otherwise lacks legal capacity.
• Treat the parental or guardian consent requirement as not applying to processing carried out for education, medical, or social care by a professional owing a duty of confidentiality, to processing necessary for court proceedings concerning the individual, or to a child of thirteen or older requesting an online service directly.

Data Protection Act 2025, ss. 1-11, 14, 18, 21-22, 32-33 (lawful basis, purpose limitation, controller and processor duties, security measures, data protection impact assessments) · Read the law's page

• Process personal data only on one of the Act's lawful bases, such as consent, contract necessity, legal obligation, or legitimate interests, and only for a purpose that is explicit and not prohibited by law.
• Further process personal data only for a purpose compatible with the original purpose, and do not retain personal data longer than necessary to achieve that purpose unless retention is required or authorised by law, necessary for a legitimate business purpose, or the data subject has consented to it.
• Implement appropriate technical and organisational measures against accidental or unlawful destruction, loss, misuse or alteration and unauthorised disclosure or access, taking into account the amount of personal data, the likelihood of harm, the extent of processing, the retention period, and the availability and cost of measures.
• Put a written agreement in place with any person who processes personal data on your behalf, requiring that person to give you the notifications and assistance you need to comply with the Act and to impose the same written-agreement requirement on anyone it engages for downstream processing.
• If you are a controller of major importance, carry out a data protection impact assessment and submit the report to the Digital Transformation Office before processing likely to expose 10,000 or more data subjects to a high risk of significant harm, and proceed only with the Office's approval if the risk remains high after mitigation; under section 21(4) this duty applies from the second anniversary of commencement, 20 August 2028.

Data Protection Act 2025, ss. 13, 15-16 (information notice and rights of data subjects) · Read the law's page

• Tell a data subject before collecting their personal data who the controller is and how to contact them, the purpose of the processing, how to exercise their Part IV rights, and how to lodge a complaint with the Digital Transformation Office, and give that information as soon as possible afterward where it could not be given beforehand.
• Give a data subject, at no expense and without unreasonable delay, confirmation of whether their personal data is being processed and its source, a copy of it in a commonly used electronic format, correction of data that is inaccurate, out of date, incomplete or misleading, and deletion of data the controller is not entitled to retain.
• Let a data subject withdraw consent previously given, or object to processing that rests on voluntary provision with no lawful basis, as easily as they gave it, tell them the consequences of doing so, and promptly stop the processing that relied solely on it.
• A manifestly unfounded or excessive request, particularly one that is repetitive, may be met with a reasonable fee or a refusal, and a fee for a copy of personal data may be charged only to the extent another law otherwise permits it.

Data Protection Act 2025, ss. 19-20 (personal data breaches) · Read the law's page

• Notify the Digital Transformation Office of a personal data breach that has resulted in, or is likely to result in, significant harm to affected data subjects, as soon as practicable after becoming aware of the breach.
• Notify each affected data subject of that same harmful personal data breach as soon as practicable after becoming aware of the breach, or by public notification through widely used media where direct notification is not feasible or would involve disproportionate effort or expense.
• Describe in the notification the nature of the breach including, where possible, the categories and approximate numbers of data subjects and personal data records concerned, a point of contact, the likely consequences, and the measures taken or expected to address the breach and mitigate its effects, supplying information in phases without undue further delay where it cannot all be given at once.
• As a person processing personal data on another person's behalf, inform that other person as soon as practicable after becoming aware of any personal data breach, regardless of whether it meets the significant-harm threshold for notifying the Office and data subjects.
• Keep a record of every personal data breach, regardless of whether it meets that threshold, including the facts, its effects and the remedial action taken, and make your threshold analysis available to the Office on request.

Data Protection Act 2025, ss. 23-25 (processing and transfers outside Kiribati) · Read the law's page

• Before processing personal data outside Kiribati or transferring it to a person outside Kiribati, take reasonable steps to verify that the recipient jurisdiction affords adequate protection, meaning restrictions and obligations substantially similar to Parts III and V, rights substantially similar to Part IV, and that those restrictions, obligations and rights are substantially enforceable.
• Where adequate protection cannot be verified, transfer or process personal data outside Kiribati only on another listed basis, such as the data subject's informed consent to the transfer, contractual necessity, a medical emergency, a transfer for the data subject's benefit where consent is impracticable but would likely be given, or a transfer under an international agreement such as a mutual legal assistance treaty.
• Comply with any prohibition, designation or guideline the Digital Transformation Office issues on whether a jurisdiction, organisation, law or measure affords adequate protection, and with any Office prohibition on transferring personal data to a specified jurisdiction, organisation or under specified measures for want of adequate protection or for reasons of national security.
• Keep a written record of the reasonable steps taken to verify adequate protection or the alternative basis relied on for processing or transferring personal data outside Kiribati, and make that record available to the Office on request.

Data Protection Act 2025, ss. 26-31 (complaints, investigations, notices, offences and civil remedies) · Read the law's page

• Attend at the time and place the Digital Transformation Office sets, produce the document, record or article it requires, or furnish a written statement under oath or affirmation, when the Office issues a notice for the purpose of an investigation, and produce or give access to information held on a device in a visible, legible, structured and machine-readable form when the Office requires it.
• Comply with a notice the Office issues after investigation requiring you, within a specified period, to stop or refrain from the violating act, compel a downstream processor to do the same, remedy the violation including compensating an affected data subject, or pay an administrative penalty of up to $100,000, proportionate to the violation's gravity, your efforts to comply, any profit made, and the harm caused.
• Comply with any notice the Office issues under section 27 or 28, unless it is the subject of a duly made and ongoing appeal under section 30.