Makes public services decisions, in Guyana

Data Protection Act 2023 (Act No. 18 of 2023), not yet commenced · Read the law's page

• A data controller must comply, for all the personal data it processes, with the data protection principles in section 4(1) of the Data Protection Act 2023: process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes; keep it adequate, accurate and identifiable for no longer than necessary; and process it with appropriate security.
• Process personal data only where a lawful basis in section 6(1) applies, such as the data subject's consent for specific purposes, performance of a contract, a legal obligation, vital interests or legitimate interests, and be able to demonstrate consent where processing rests on it.
• Register in the Register of Data Controllers before operating as a data controller, nominate a representative established in Guyana if you are not established there, and register as a data processor before operating as one (sections 51 and 57).
• Keep a record of processing activities, apply appropriate technical and organizational security measures, designate a data protection officer where section 69 requires one, and carry out an impact assessment before processing likely to result in a high risk (sections 62, 64, 67 and 69).

Data Protection Act 2023, s. 19 (automated individual decision-making including profiling) · Read the law's page

• Once the Data Protection Act 2023 is commenced, do not take a decision based solely on automated processing, including profiling, that produces legal effects concerning a data subject or similarly significantly affects them, unless it is necessary for a contract with the data subject, authorized by a law that lays down suitable safeguards, or based on the data subject's consent.
• Where you rely on the contract or consent exception, implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests.
• Do not rely on those exceptions for sensitive personal data unless the decision is in the public interest and suitable safeguards for the data subject are in place.