BelizeData Protection Act 2021, comprehensive regime
Data Protection Act, 2021 (Act No. 45 of 2021), ss. 2-22
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.nationalassembly.gov.bz/wp-content/uploads/2021/12/Act-No-45-of-2021-Data-Protection-Act.pdfA comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Obligation class
- Consent, Disclosure, Data subject rights, Biometric, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Before processing personal data of a person in Belize, establish a lawful basis such as consent, a contract with the data subject, or a legal obligation, and process it fairly, transparently, and only for the specified purpose.NIST Privacy FrameworkCT.PO-P1
- Do not process sensitive personal data, including biometric data such as a voiceprint or faceprint, unless a listed condition applies, such as the data subject's consent or a deliberate act by the data subject making the information public.NIST Privacy FrameworkCT.PO-P1
- Give a data subject access to, and the ability to correct, erase, restrict, or port, their personal data on request.NIST Privacy FrameworkCT.PO-P3
- Do not base a decision solely on automated processing, including profiling, that produces a legal or similarly significant effect on a person, unless a contract, an authorising enactment with safeguards, or the person's consent applies, and never for sensitive personal data outside the public interest.NIST Privacy FrameworkCT.DM-P10
- Stop processing a person's personal data for direct marketing once they object.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
A data controller must, where the Commissioner asks, demonstrate compliance with the section 4 principles, and where processing rests on consent must demonstrate that the data subject consented. Neither section names a log or register, but both can be met only from records the controller keeps. Section 3 states the territorial scope in words, so the hook is express.
- Kind
- Implicit
- As of
- Provision
- Data Protection Act 2021, sections 5(1) and 8(1)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
The Act applies to the processing of personal data by a data controller or processor established in Belize, and to the processing of personal data of data subjects in Belize by a controller or processor established elsewhere where the processing relates to offering goods or services to those data subjects, subject to an exemption for a small business (annual turnover of $3,000,000 or less) that does not extend to a business trading in personal information, providing a health service, or several other listed activities.
Section 4 sets the standard lawfulness, purpose-limitation, and data-minimisation principles, and section 7 requires a lawful basis such as consent, a contract with the data subject, or a legal obligation before processing.
Section 10 prohibits processing sensitive personal data, which includes racial or ethnic origin, religious belief, genetic data, biometric data, and sexual orientation, unless one of a listed set of conditions applies, among them the data subject's consent or a deliberate act by the data subject making the information public; section 9 sets the age of digital consent for a child's own consent at thirteen.
Sections 11 to 18 give a data subject rights of access, rectification, erasure, restriction, and data portability, and a right to prevent processing likely to cause damage or distress or intended for direct marketing.
Section 19 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal or similarly significant effect, subject to exceptions for a contract, an authorising enactment with safeguards, or the data subject's consent. Section 19(4) withholds those exceptions from sensitive personal data unless the processing is in the public interest with suitable safeguards in place. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes biometric data, makes high-risk automated decisions, sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .