BelizeData Protection Act 2021, Commissioner, Tribunal, and enforcement
Data Protection Act, 2021 (Act No. 45 of 2021), ss. 68-92
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.nationalassembly.gov.bz/wp-content/uploads/2021/12/Act-No-45-of-2021-Data-Protection-Act.pdfAn enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Comply with an Enforcement Notice, Information Notice, or Special Information Notice the Data Protection Commissioner issues, or answer to the Data Protection Tribunal on appeal.
- An individual harmed by a contravention of the Act may claim compensation from the data controller or processor responsible.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Failing to comply with an Enforcement Notice, an Information Notice, or a Special Information Notice is an offence carrying a fine of five thousand dollars on summary conviction; making a false statement in purported compliance with an Information Notice carries a fine of twenty thousand dollars (s. 81).
Penalty structure
Section 81(1) sets a fine of five thousand dollars for failing to comply with an Enforcement Notice, an Information Notice, or a Special Information Notice; section 81(2) sets a fine of twenty thousand dollars for making a false statement in purported compliance with an Information Notice. A separate offence at section 92 for unlawfully obtaining personal data carries its own fine of ten thousand dollars.
- Rule
- Fixed only
- As of
- Currency
- BZD
- Fixed cap
- 20,000
Who enforces it
Enforcement body
The Data Protection Commissioner, a public officer in the ministry responsible for digital transformation, e-governance or information technology, who is to monitor and enforce the application of the Act.
Settledness
- As of
- Open questions
- Does any provision of the Data Protection Act, 2021 bind a data controller or a data processor before the Minister appoints a day by Order under section 97(1), and has such an Order been published in the Gazette?
- Does "damage or distress" in section 91(1) entitle an individual to compensation for distress alone, when the compensation runs "for that damage"?
- Which body hears an appeal against a decision of the Commissioner under section 89(6) until the Minister prescribes the constitution of the Data Protection Tribunal by Order under section 88(2)?
What it makes you log
Logging duty
Sections 68 to 92 set up the Commissioner and the Tribunal and the enforcement, information and special information notices, and impose no duty on a data controller or processor to keep a log or record. Section 69(w) has the Commissioner keep internal records of contraventions, which is the regulator's own record. Section 69(e) lets the Commissioner audit the data a person processes at his own discretion or on a request, which is the audit read here.
- Kind
- None
- As of
What this law does
The Act creates a Data Protection Commissioner, a public officer in the ministry responsible for digital transformation who monitors and enforces the Act and must act independently, and a Data Protection Tribunal to hear appeals from an Enforcement, Information, or Special Information Notice the Commissioner issues, with a further appeal on a point of law to the Supreme Court.
Section 91 entitles an individual who suffers damage or distress from a controller's or processor's contravention of the Act to compensation, subject to a defence that the defendant took all reasonably required measures to comply.
Separately, section 92 makes it an offence for a person to knowingly or recklessly obtain, disclose, or procure the disclosure of personal data without the controller's consent, punishable by a fine of ten thousand dollars, subject to defences including that the obtaining was necessary to prevent or detect crime or was in the public interest. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .