BoliviaReglamento para el Desarrollo de TIC, Tratamiento de los Datos Personales
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Transfer, Security
- Audit expectation
- none
What it requires
- Obtain a person's prior knowledge and express consent before collecting, processing, blocking, cancelling, transferring, consulting, or interconnecting their personal data.NIST Privacy FrameworkCT.PO-P1
- Before asking someone for their personal data, tell them it will be processed, why, who may receive it, who is responsible for it and how to reach that party, and that they may exercise access, rectification, updating, cancellation, objection, and revocation rights.NIST Privacy FrameworkCM.AW-P1
- Do not use personal data for a purpose other than the one stated when it was collected.NIST Privacy FrameworkGV.PO-P1
- Do not use, communicate, or transfer personal data to a third party without the data subject's consent or a competent court's written order.NIST Privacy FrameworkCT.PO-P1
- Adopt technical and organisational measures, matched to the state of technology and the data's nature and risk, to keep personal data secure and prevent its alteration, loss, or unauthorised processing.NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
2 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 56 of Decreto Supremo 1793 sets the form of consent (in writing or by an equivalent means) as a condition of processing; it names no record the holder keeps and no duty to prove the consent later, so the article states no record duty.
- Kind
- None
- As of
What this law does
Article 56 of the Reglamento para el Desarrollo de Tecnologías de Información y Comunicación, approved by Decreto Supremo No. 1793, sets a general set of personal-data-processing principles to guarantee personal data and its computer security.
Collecting, processing, blocking, cancelling, transferring, consulting, or interconnecting personal data, in the public and private sectors in all its forms, requires the data subject's prior knowledge and express consent, revocable for justified cause though not retroactively.
A person asked for personal data must be told beforehand that it will be processed, the purpose of collecting and registering it, its potential recipients, the identity and address of the party responsible for the processing, and the possibility of exercising rights of access, rectification, updating, cancellation, objection, and revocation.
Data may not be used for purposes other than those stated when collected, and may only be used, communicated, or transferred to a third party with the data subject's consent or a competent court's written order.
The party responsible for the processing, public or private, must adopt the technical and organisational measures necessary to secure the personal data and prevent its alteration, loss, or unauthorised processing, calibrated to the state of technology, the nature of the stored data, and the risks the data faces.
The Reglamento's own scope article states that it applies to natural or legal persons, public or private, engaged in activities or services related to digital certification, e-government, free software, and electronic commerce, so this chapter sits structurally within the Reglamento's title on digital-certificate holders even though its own text states the processing principles broadly, for the public and private sectors in all their forms.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .