KiribatiData Protection Act 2025
Data Protection Act 2025 ss. 1-11, 14, 18, 21-22, 32-33 (lawful basis, purpose limitation, controller and processor duties, security measures, data protection impact assessments)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, User location
- Obligation class
- Consent, Retention, Security, Governance, DPIA
- Audit expectation
- none
What it requires
- Process personal data only on one of the Act's lawful bases, such as consent, contract necessity, legal obligation, or legitimate interests, and only for a purpose that is explicit and not prohibited by law.NIST Privacy FrameworkCT.PO-P1
- Further process personal data only for a purpose compatible with the original purpose, and do not retain personal data longer than necessary to achieve that purpose unless retention is required or authorised by law, necessary for a legitimate business purpose, or the data subject has consented to it.NIST Privacy FrameworkGV.PO-P1
- Implement appropriate technical and organisational measures against accidental or unlawful destruction, loss, misuse or alteration and unauthorised disclosure or access, taking into account the amount of personal data, the likelihood of harm, the extent of processing, the retention period, and the availability and cost of measures.NIST Privacy FrameworkPR.DS-P5
- Put a written agreement in place with any person who processes personal data on your behalf, requiring that person to give you the notifications and assistance you need to comply with the Act and to impose the same written-agreement requirement on anyone it engages for downstream processing.NIST Privacy FrameworkID.DE-P3
- If you are a controller of major importance, carry out a data protection impact assessment and submit the report to the Digital Transformation Office before processing likely to expose 10,000 or more data subjects to a high risk of significant harm, and proceed only with the Office's approval if the risk remains high after mitigation; under section 21(4) this duty applies from the second anniversary of commencement, .NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 21(1) makes a controller of major importance that expects its processing to expose 10,000 or more data subjects to a high risk of significant harm carry out a data protection impact assessment before the processing and submit the report to the Office, and section 21(3) lets the Office approve or condition the processing on it. The section names no log or register, so the duty is carried by the report that must be produced to the Office, once and before the processing, and section 21(4) holds it back until the second anniversary of the Act's entry into force. Section 14(1)(a) makes a processor give the controller the information it needs to demonstrate compliance, which names no record. Section 18 asks for security measures without naming a log, and section 10(e) on retention limits the personal data rather than a record. Section 5(1)(a), which applies the Act to processing within Kiribati, turns on where the processing happens and is left out of the hook. The Kiribati copy cited is the Clerk's certified printed copy of the Bill as passed by the Maneaba ni Maungatabu on , with the Act number, the assent and the commencement date left blank, so the wording is that of the passed Bill and the gazetted Act has not been compared with it.
- Kind
- Implicit
- As of
- Provision
- Section 21(1)(b) (a controller of major importance submits its data protection impact assessment report to the Office); Section 14(1)(a) (a processor gives the information a controller needs to demonstrate compliance)
- Trigger
- personal_data_processing
What this law does
Section 5 applies the Act to processing personal data within Kiribati and, outside Kiribati, to processing that offers goods or services to, or monitors the behaviour of, data subjects in Kiribati. Section 5(3) states that the Act binds the Republic.
Section 6 exempts personal, household or recreational processing and excludes processing by legally authorised authorities for criminal law enforcement, public health emergencies or national security, processing necessary to a legal claim, and processing for journalistic, educational, artistic or literary expression. Section 6(2) defers the Act for two years after commencement for a person who is not a controller of major importance.
Section 10 requires a controller to process personal data only for an explicit purpose compatible with the purpose of collection, to limit processing to what that purpose requires, to keep the data accurate and current, and not to retain it longer than necessary unless retention is authorised by law, needed for a legitimate business purpose, or consented to.
Section 11 lists twelve lawful bases for processing, including consent, voluntary provision, contractual necessity, a legal obligation, a public authority's lawful function, a medical or public health emergency, legitimate interests that do not override the data subject's fundamental rights, archiving or research, and data the data subject has intentionally made public.
Section 14 requires a controller to take reasonable measures, including a written agreement, to bind any person processing personal data on its behalf to the Act, and to pass the same written-agreement duty down to further processors. Section 18 requires appropriate technical and organisational security measures against accidental or unlawful destruction, loss, misuse, alteration, or unauthorised disclosure or access.
Section 21 requires a controller of major importance to carry out a data protection impact assessment and submit it to the Digital Transformation Office before processing likely to expose 10,000 or more data subjects to a high risk of significant harm. Section 21(4) applies that section only from the second anniversary of commencement. Sections 32 and 33 give the Minister power to make regulations and state that the Act does not limit any other obligation or right under Kiribati law.
Section 2 leaves commencement to a notice the Minister may appoint. By a notice under section 2, the Minister appointed as the day the Act came into force.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .