Processes personal data, in Saint Kitts and Nevis

Data Protection Act, 2018, s. 20 (processing of sensitive personal data) · Read the law's page

• Do not process sensitive personal data, meaning information about a data subject's physical or mental health, sexual orientation, political opinions, religious or similar beliefs, or an offence they committed or are alleged to have committed, unless a listed exception applies.
• Process sensitive personal data only with the data subject's explicit consent, for an employment right or obligation, to protect vital interests where consent cannot be given or has been unreasonably withheld, for medical purposes by a healthcare professional or an equivalent confidant, for legal proceedings, advice, or the administration of justice, or where the data subject has deliberately made the information public.

Data Protection Act, 2018, ss. 13-18 (rights of data subjects) · Read the law's page

• Give a data subject access to their personal data on request and payment of the prescribed fee, describing the data, the purposes of processing, the recipients, and the source of the data.
• Give written notice of your access decision within thirty days of a data subject's request, or notify an extension of up to thirty days in the circumstances the Act lists, and tell the data subject of their right to complain to the Information Commissioner.
• Refuse an access request only where you lack information to identify the requester or locate the data, compliance would breach an exemption or a duty of confidentiality, another identifiable individual has not consented to disclosure, or the Information Commissioner has not approved the refusal in writing.
• Let a data subject examine their personal data or obtain a copy, and provide it in an alternative format where the data subject has a sensory disability and it is practicable to do so.
• Correct personal data a data subject claims in writing is incomplete, incorrect, misleading, excessive, or irrelevant once satisfied of the claim, or tell the data subject of your refusal, your reasons, and their right to complain to the Information Commissioner within twenty eight days.

Data Protection Act, 2018, ss. 23-38 (Information Commissioner, enforcement and offences) · Read the law's page

• Furnish the Information Commissioner with access to personal data, documentation of its processing, or information about its security, in writing within the time an information notice specifies.
• Comply with an enforcement notice the Information Commissioner serves within the time it states, and notify the data subject and anyone the data was disclosed to in the twelve months before the notice, within thirty days of complying, if compliance materially modifies the data.
• Do not obstruct the Information Commissioner or an authorised officer in the conduct of their duties.
• Do not dismiss, suspend, demote, discipline, harass, or otherwise disadvantage an employee for reporting or refusing to participate in a contravention of the Act in good faith.
• Do not wilfully disclose personal information in contravention of the Act, or collect, store, or dispose of personal information in a manner that contravenes the Act.

Saint Christopher and Nevis Data Protection Act, 2018 (No. 5 of 2018), ss. 1-12, 19 and 21-22 · Read the law's page

• Obtain a data subject's consent before processing their personal data other than sensitive personal data, unless a listed exception applies.
• Before collecting personal data, tell the data subject the purpose of collection, the source of the data where available, the classes of third party it may be disclosed to, whether supplying the data is obligatory or voluntary, and how to request access or correction.
• Do not disclose personal data for a new purpose without the data subject's consent, except where crime prevention or detection, legal authorisation, a reasonable belief in a right or in the data subject's consent, or the public interest applies.
• Take practical steps to protect personal data from loss, misuse, unauthorised access, alteration or destruction, having regard to the nature of the data, its storage, and the personnel with access to it, and require a data processor you engage to give sufficient security guarantees and comply with them.
• Do not keep personal data longer than the purpose requires, and take reasonable steps to destroy or permanently delete it once no longer needed.
• Take reasonable steps to keep personal data accurate, complete, not misleading and up to date.