BhutanCybersecurity Code of Practice for ICT/Telecommunications Service Providers, privacy and PII duty
Cybersecurity Code of Practice for ICT/Telecommunications Service Providers (issued under Information, Communications and Media Act of… Bhutan 2018, s.58), s.8.6
In force since .
An enforcement supervision rule binding private bodies.
- Audit expectation
- none
What it requires
- A Telecom Service Provider or other ICT service provider with critical information infrastructure in Bhutan must establish and communicate a privacy and PII-protection policy, implement procedures to preserve that privacy, including for a biometric identifier such as a voiceprint or faceprint handled as PII, and put in place appropriate technical and organizational measures, consistent with its reporting obligations under the Information, Communications and Media Act of Bhutan 2018.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Code is the Authority's own instrument, which the Authority amends, so it stands as its own guidance on clause 8.6.
- As of
- Open questions
- Does clause 3, which applies the Code to "other ICT Service providers having critical information infrastructure", reach an application provider that holds no licence from the Authority, given that clause 8.6 binds "The licensee", defined as "the ICT/telecommunications service providers who have obtained a license from the Authority"?
- Which instruments are the "relevant legislation and regulations concerning the preservation of privacy and protection of PII" that clause 8.6(c) requires a licensee to comply with?
What it makes you log
Logging duty
Clause 8.6 requires the licensee to publish a privacy and PII policy, to develop and implement procedures for preserving privacy and protecting PII, and to put in place roles, responsibilities and technical and organisational measures. It names no log, register or record of PII processing. Logging is a separate duty in clause 11.2 (logs of system activities and security events, retained for at least 2 months, produced to the Authority on demand) and clause 11.3 (internal audits), which this row does not cite and which are not applied to it. The clause 3 scope sentence limits the Code to Telecom Service Providers and other ICT providers with critical information infrastructure and states no territorial hook.
- Kind
- None
- As of
What this law does
Issued by BICMA under section 58 of the ICM Act as a binding code of practice for licensed Telecom Service Providers and other ICT service providers operating critical information infrastructure, in force since .
Section 8.6 requires a licensee to establish and communicate a topic-specific policy on privacy and protection of Personally Identifiable Information (PII), to implement procedures for preserving that privacy, and to put in place appropriate technical and organizational measures, expressly deferring compliance to "relevant legislation and regulations" (the ICM Act's own Chapter 21 duties).
Section 5 defines personally identifiable information as any information that can be used to establish a link between the information and the natural person to whom it relates, or that can be directly or indirectly linked to a natural person, without naming biometric data as an example, and its incident-response requirement (s.12.1) requires only that a licensee's Incident Response Plan include a reporting structure aligned with "its reporting obligations under the Act and any other laws and regulations"; it creates no independent breach-notification threshold, recipient, or timeline of its own.
It is a separate, more recent, government-issued instrument, not a republication of the ICM Act.
When LexLint raises it
When your app profile says your app provides telecom services or processes personal data.
Back to the example · Lint your app
Page updated .