Processes personal data, in Samoa

Telecommunications Act 2005, No. 20 (Samoa), ss. 48-51, 75A-75B (confidentiality and protection of customer personal information) · Read the law's page

• Do not disclose information concerning a telecommunications customer without the customer's written consent, unless disclosure is required or permitted by the Regulator or by law.
• Take all reasonable steps to keep customer communications confidential, and do not intercept, monitor, alter, or modify their content except as the Act permits.
• Identify the purposes for which customer information is collected at or before collection, and do not collect, use, maintain, or disclose customer information for an undisclosed purpose without the customer's consent or legal authority.
• Do not divulge information overheard from a customer's telephone conversation, or a customer's personal particulars obtained in the course of duties, without good and sufficient cause.

National Digital Identification Act 2024, No. 3 (Samoa), ss. 47-50 (personal data breach notification) · Read the law's page

• As a relying party or data processor in the National Digital Identification System, notify the Registrar General (a data processor may notify the relying party instead) of a personal data breach within 72 hours of becoming aware of it, describing the categories and approximate number of registered persons and records concerned; the 72 hours may be extended for the needs of law enforcement or as reasonably necessary to determine the scope of the breach.
• As the Registrar General, where a personal data breach has occurred in the National Digital Identification System or you are informed of one by a data processor or relying party, and it is likely to result in a high risk to a registered person's rights, communicate the breach to that person without undue delay, in plain and clear language, with advice on measures to mitigate its adverse effects.for a public body
• Keep a record of every personal data breach, its effects, and the remedial action taken, sufficient to demonstrate compliance with the Act's breach notification duties.
• Do not disclose, transmit, copy, or otherwise disseminate personal data collected or processed under the Act to a person not authorised under the Act or its regulations.

National Digital Identification Act 2024, No. 3 (Samoa), ss. 54 and 58 (non-compliance, information requests and penalties) · Read the law's page

• As a relying party or data processor in the National Digital Identification System, comply with every provision of the National Digital Identification Act 2024 and its regulations.
• On the Registrar General's request, provide any information about your activities under the Act that the Registrar General asks for to verify your compliance.