LexLint.ioBeta

Know the law your code answers to.

Law / Antigua and Barbuda

Data Protection Act, 2013

Data Protection Act, 2013 (No. 10 of 2013), ss. 5, 7-10, 17, 19-20

In force since .

A comprehensive regime rule binding public and private bodies.

Obligation class
Consent, Disclosure, Security, Retention
Audit expectation
none

What it requires

  • Obtain a data subject's consent before processing their personal data, other than sensitive personal data, arising from a commercial transaction, unless a listed alternative ground such as contract performance, a legal obligation, protecting vital interests or the administration of justice applies.NIST Privacy FrameworkCT.PO-P1
  • Process personal data only for a lawful purpose directly related to your activity, keep the processing necessary for that purpose, and keep the data adequate but not excessive for it.NIST Privacy FrameworkGV.PO-P1
  • Do not disclose personal data for a purpose other than the one notified at collection, or a purpose directly related to it, without the data subject's consent, unless a listed exception applies, such as preventing or detecting crime, complying with a court order, or a public interest determination by the Minister.NIST Privacy FrameworkCT.PO-P2
  • Take practical security steps against loss, misuse, unauthorised or accidental access, disclosure, alteration or destruction of personal data, having regard to its sensitivity, where it is stored, and the reliability of personnel with access, and secure the same guarantees from any data processor you engage.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkID.DE-P2
  • Do not keep personal data longer than necessary for the purpose it was collected for, and destroy or permanently delete it once that purpose has lapsed.NIST Privacy FrameworkCT.DM-P5
  • Keep personal data accurate, complete, not misleading and up to date, having regard to the purpose it was collected and further processed for.NIST Privacy FrameworkCT.PO-P2

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
  • GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
  • CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
  • CT.DM-P5Data are destroyed according to policy.
  • PR.DS-P5Protections against data leaks are implemented.
NIST CSF 2.0
  • GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
  • PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
FINOS AIGF
3 more

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

The Act's principles in sections 5, 7, 8, 9 and 10 require consent or another ground for processing, limit disclosure, require practical security steps against loss, misuse, modification and unauthorized access, bar keeping personal data longer than needed (section 9, a limit on the personal data itself and not on a record about it) and require accurate data. None requires a person to make, keep or produce a log or record. Section 8 asks for security measures and does not name an access log. The exemptions in sections 19 and 20 add no record duty. The Act has no territorial scope clause, so the hook is empty.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 5 requires a data user to obtain a data subject's consent before processing personal data other than sensitive personal data, unless the processing is necessary for a listed alternative ground such as performing a contract, complying with a legal obligation, protecting the data subject's vital interests, the administration of justice, or exercising a function conferred by law, and requires every such processing to be for a lawful purpose directly related to the data user's activity, necessary for that purpose, and adequate but not excessive.

Section 7 bars disclosing personal data for a purpose other than the one notified at collection, or a purpose directly related to it, without the data subject's consent, subject to the exceptions in section 17.

Section 17 lets a data user disclose personal data for a different purpose where the data subject consents, the disclosure prevents or detects crime or is required or authorized by law or a court order, the data user reasonably believed it had the right to disclose or would have had the data subject's consent, or the Minister determines the disclosure is justified in the public interest.

Section 8 requires a data user to take practical security steps against loss, misuse, unauthorized or accidental access, disclosure, alteration or destruction of personal data, having regard to its sensitivity, where it is stored, the security measures built into that storage, and the reliability of personnel with access, and requires the same guarantees from a data processor engaged on the data user's behalf.

Section 9 bars keeping personal data longer than necessary for the purpose it was processed for. Section 10 requires a data user to keep personal data accurate, complete, not misleading and up to date, having regard to the purpose it was collected and further processed for.

Section 19 exempts personal data processed for an individual's personal, family or household affairs entirely, and exempts data processed for crime prevention or investigation, apprehension or prosecution of offenders, or tax assessment and collection, for preparing statistics or conducting research, for a court order or judgment, or for discharging regulatory functions, from the General, Notice and Choice, Disclosure and Access Principles, and exempts data processed only for journalistic, literary or artistic purposes from those principles plus the Retention and Data Integrity Principles, where publication would be in the public interest.

Section 20 lets the Minister, on the Information Commissioner's recommendation, exempt a data user or class of data users from any or all of the Act's principles by Order published in the Gazette. The Act states no commencement date of its own. Under section 5(1) of the Statutes Act, a statute not expressed to come into operation on a particular day comes into operation on the day it is published in the Gazette.

The Act received the Governor-General's assent on and was published in the Official Gazette (Vol. XXXIII No. 64) on .

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .