GuyanaData Protection Act 2023
Data Protection Act 2023 (Act No. 18 of 2023), not yet commenced
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Governance, Consent, Security, DPIA
- Audit expectation
- none
What it requires
- A data controller must comply, for all the personal data it processes, with the data protection principles in section 4(1) of the Data Protection Act 2023: process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes; keep it adequate, accurate and identifiable for no longer than necessary; and process it with appropriate security.
- Process personal data only where a lawful basis in section 6(1) applies, such as the data subject's consent for specific purposes, performance of a contract, a legal obligation, vital interests or legitimate interests, and be able to demonstrate consent where processing rests on it.
- Register in the Register of Data Controllers before operating as a data controller, nominate a representative established in Guyana if you are not established there, and register as a data processor before operating as one (sections 51 and 57).
- Keep a record of processing activities, apply appropriate technical and organizational security measures, designate a data protection officer where section 69 requires one, and carry out an impact assessment before processing likely to result in a high risk (sections 62, 64, 67 and 69).
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Section 62(1) requires a data controller, and section 62(2) a data processor, to maintain a record of processing activities, which lists among other things the purposes of the processing, the categories of data subjects, personal data and recipients, and any transfers abroad; those items are not in the closed list of log contents. Section 7(1) separately requires a controller that relies on consent to be able to demonstrate that the data subject consented. The cited sections do not say the record is produced to the Commissioner (section 63, which obliges cooperation on request, is not cited by this row), so no regulator access and no audit is recorded. Section 3(1) is the scope clause: it reaches processing in the context of an establishment in Guyana, and processing of data subjects in Guyana that relates to offering goods or services to them or to monitoring their behavior in Guyana; its prong for a controller that uses equipment in Guyana turns on where the means are located and has no hook value. The text read is the Data Protection Bill 2023 as published by the Ministry of Legal Affairs, because the Parliament's page for Act No. 18 of 2023 serves a scanned PDF with no text layer.
- Kind
- Explicit
- As of
- Provision
- Section 62(1) and (2) (the record of processing activities), with section 7(1) (the controller must be able to demonstrate consent)
- Trigger
- personal_data_processing
- consent_or_optout
Why the legislator wanted it
The Bill's explanatory memorandum, in its description of Part II, says why the controller keeps the consent record.
- As of
- Quote
- Data controllers have the duty to keep a verifiable record of the consent.
- Source link
- https://mola.gov.gy//bills/DATA PROTECTION BILL 20231694715430.pdf
- Source kind
- Explanatory memorandum
- Purpose
- accountability_demonstration
What this law does
Section 3(1) applies the Act to a data controller or data processor established in Guyana, and to one not established there that uses equipment in Guyana for processing or whose processing relates to offering goods or services to data subjects in Guyana or monitoring their behavior there.
Section 4(1) requires personal data to be processed lawfully, fairly and transparently, collected for specified, explicit and legitimate purposes, kept adequate, accurate and no longer than necessary, and processed with appropriate security. Section 4(2) makes the data controller answerable for complying with all of it.
Section 6(1) makes processing lawful only on a listed basis, beginning with the data subject's consent for one or more specific purposes and running through contract, legal obligation, vital interests, public functions and legitimate interests. Section 7 requires the controller to be able to demonstrate consent and to inform the data subject of the right to withdraw it.
Section 51(1) bars a person from operating as a data controller unless registered in the Register of Data Controllers, section 51(3) requires a controller not established in Guyana to nominate a representative established there. Section 57 imposes the same registration rule on data processors.
Section 62 requires a record of processing activities, section 64 requires appropriate technical and organizational security measures, section 67 requires an impact assessment before processing likely to result in a high risk. Section 69 requires a data protection officer in the cases it lists. Section 1 provides that the Act comes into operation on the day the Minister appoints by order, and that different days may be appointed for different provisions.
The National Assembly gazetted the Data Protection Act 2023 as Act No. 18 of 2023 on , following passage on . As of the date below, no commencement order under the Act has been located, and a report of states that the requisite commencement order has not been issued. Guyana's Digital Identity Card Act 2023 came into operation before the Data Protection Act was commenced.
The Digital Identity Card Act's Commissioner and safeguard duties are created by the Data Protection Act, so commentators quoted in that report flagged them as unenforceable while the Data Protection Act was not in force.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .