GrenadaData Protection Act, No. 1 of 2023, sensitive personal data
Data Protection Act, No. 1 of 2023, s. 21 (sensitive personal data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.laws.gov.gd/index.php/acts/971-act-no-1-of-2023-data-protection-2023/viewdocument/971A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Do not process sensitive personal data, including health, genetic, biometric, sex life, political or religious information, except on one of the Act's listed grounds, ordinarily the data subject's written consent.
- Where you rely on a ground other than consent, confirm it is one the Act lists: an employment right or obligation, protecting the data subject's or another person's interests where consent cannot reasonably be obtained, medical purposes handled under a duty of confidentiality, legal proceedings or advice, the administration of justice, a government function, or information the data subject has already made public.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 21 sets the conditions for processing sensitive personal data: the data subject's written consent, or one of the listed necessity grounds, with an offence for breach. A consent that must be given in writing is a condition of processing; the section does not oblige the data user to keep or produce a record of it, and it names no log, register or retention period.
- Kind
- None
- As of
What this law does
Section 21 bars a data user from processing sensitive personal data, defined in section 2 to include an individual's physical or mental health or condition, racial or ethnic origin, genetic data, biometric data that uniquely identifies an individual, sex life, political opinions, religious or philosophical beliefs, and the commission or alleged commission of an offence, except on the conditions section 21(1) lists.
The data subject's written consent to the processing of the sensitive personal data is the first of those conditions, and the others include processing necessary to an employment right or obligation, protecting the data subject's or another person's interests where consent cannot reasonably be obtained or has been unreasonably withheld, medical purposes undertaken by a healthcare professional or someone under an equivalent duty of confidentiality, legal proceedings or advice, the administration of justice, a statutory or government function, another purpose the Minister thinks fit, or information the data subject has made public.
A person who contravenes section 21(1) commits an offence and is liable, on conviction on indictment, to a fine not exceeding two hundred thousand dollars or imprisonment for a term not exceeding two years, or both. No notice appointing the day the Act comes into force has been located.
When LexLint raises it
When your app profile says your app processes biometric data, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .