GrenadaData Protection Act, No. 1 of 2023
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.laws.gov.gd/index.php/acts/971-act-no-1-of-2023-data-protection-2023/viewdocument/971A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Disclosure, Retention, Security, Governance
- Audit expectation
- periodic
- Who audits it
- Self
What it requires
- Establish a lawful basis, ordinarily the data subject's consent, before processing personal data about them, or rely on one of the Act's specific alternative grounds such as contractual necessity, a legal obligation, or a statutory or government function.NIST Privacy FrameworkCT.PO-P1
- Process personal data only for a lawful purpose directly related to your activity, and hold no more than is adequate and not excessive for that purpose.NIST Privacy FrameworkGV.PO-P1
- Do not disclose personal data for a new purpose or to a new class of recipient without the data subject's consent, unless the disclosure prevents or detects crime, is authorised by an enactment or court order, or the Minister deems it justified as being in the public interest.NIST Privacy FrameworkCT.PO-P2
- Take practical steps to secure personal data against loss, misuse, unauthorised access, alteration or destruction, and obtain a data processor's own security guarantees before letting it process personal data on your behalf.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkID.DE-P2
- Do not retain personal data longer than necessary for the purpose it was processed for, and take reasonable steps to keep it accurate, complete and up to date.NIST Privacy FrameworkCT.PO-P2
- Establish formal procedures implementing these principles, and review them, with a self-assessment, at least once every five years.NIST Privacy FrameworkGV.MT-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 14 requires every data user to establish formal procedures and implement compliance with the principles, to review those procedures and conduct a self-assessment at least once in every five years, and lets the Commission request particulars of the procedures implemented. The section names no log, register or retention period; the particulars the Commission may request can only be answered from records the data user keeps. Section 4(2)(b), which reaches a person not established in Grenada that uses equipment or network services there, turns on where the equipment is and is left out of the territorial hook.
- Kind
- Implicit
- As of
- Provision
- Section 14(1), (3) and (4)
- Trigger
- personal_data_processing
What this law does
The Data Protection Act, No. 1 of 2023 applies to a person who processes, controls or authorises the processing of personal data in respect of commercial transactions in Grenada, reaching a person established in Grenada and, under section 4(2)(b), a person established elsewhere who uses equipment or network services in Grenada for processing personal data.
Section 7 bars a data user from processing personal data about a data subject without the data subject's consent, subject to the alternative grounds in section 7(2) such as contractual necessity, a legal obligation, protecting the data subject's interests, the administration of justice or the exercise of a statutory or government function, and section 7(3) requires the processing to be for a lawful purpose directly related to the data user's activity and adequate but not excessive for that purpose.
Section 9 bars a data user from disclosing personal data, without the data subject's consent, for a new purpose or to a new class of recipient, and section 20 lets a data user disclose personal data for another purpose only where the data subject consents, the disclosure is necessary to prevent or detect crime or for investigations, the disclosure is required or authorised by an enactment or court order, or the Minister deems the disclosure justified as being in the public interest.
Section 10 requires a data user to take practical steps to protect personal data against loss, misuse, unauthorised access, alteration or destruction, including obtaining a data processor's guarantees of its own technical and organisational security measures, and section 11 bars retention of personal data longer than necessary for the purpose it was processed for.
Section 12 requires a data user to take reasonable steps to keep personal data accurate, complete, not misleading and up to date, and section 14 requires every data user to establish formal procedures implementing these principles and to review them at least once every five years.
Sections 22 and 23 exempt personal data processed for an individual's own personal, family, household or recreational purposes, and let the Minister exempt further data users or provisions by Order published in the Gazette, alongside the Act's own exemptions for crime prevention and investigation, health information whose disclosure would cause serious harm, anonymised statistics and research, court orders, regulatory functions, and journalistic, literary or artistic purposes meeting a public interest test.
Section 1(2) delays the Act's commencement to a day the Minister appoints by Order in the Gazette, and no commencement Order has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .