KiribatiData Protection Act 2025, children and individuals lacking capacity
Data Protection Act 2025, s. 12 (consent for children and individuals lacking capacity)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Age verification
- Audit expectation
- none
What it requires
- Obtain consent from a parent, guardian, or other appropriate legal representative before relying on the consent of a data subject who is under eighteen or otherwise lacks legal capacity, wherever the Act requires the data subject's consent for a lawful basis, retention, an automated decision, or a cross-border transfer.NIST Privacy FrameworkCT.PO-P1
- Obtain that same consent from a parent, guardian, or other appropriate legal representative before relying on a data subject's voluntary provision of personal data as a lawful basis, where the data subject is under eighteen or otherwise lacks legal capacity.NIST Privacy FrameworkCT.PO-P1
- Let a parent, guardian, or other appropriate legal representative exercise a data subject's rights or lodge a complaint on behalf of a data subject who is under eighteen or otherwise lacks legal capacity.NIST Privacy FrameworkCT.PO-P3
- Treat the parental or guardian consent requirement as not applying to processing carried out for education, medical, or social care by a professional owing a duty of confidentiality, to processing necessary for court proceedings concerning the individual, or to a child of thirteen or older requesting an online service directly.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 12 sends the consent, the voluntary provision of data and the exercise of rights of a person under eighteen or lacking capacity to a parent, guardian or other legal representative, and lists the cases where that rule does not apply. It states who acts and names no log, register or record, and no authority or auditor. The section has no scope clause. The Kiribati copy cited is the Clerk's certified printed copy of the Bill as passed by the Maneaba ni Maungatabu on , with the Act number, the assent and the commencement date left blank, so the wording is that of the passed Bill and the gazetted Act has not been compared with it.
- Kind
- None
- As of
What this law does
Section 12(1) requires that wherever the Act would otherwise rely on a data subject's consent, including the retention consent under section 10(e)(iii), the automated-decision consent under section 17(c), the lawful-basis consent under section 11(2)(a), or the cross-border-transfer consent under section 24(a), that consent be obtained instead from a parent, legal guardian, or other appropriate legal representative where the data subject is under eighteen or otherwise lacks legal capacity.
Section 12(1)(b) applies the same substitution to the voluntary provision of personal data that section 11(2)(b) or section 24(b) treats as a lawful basis. Section 12(1)(c) requires a parent, guardian, or other appropriate legal representative to exercise a data subject's Part IV rights or lodge a complaint under section 26 on that data subject's behalf.
Section 12(2) disapplies the parental consent requirement for processing carried out for education, medical, or social care by a professional owing a duty of confidentiality, or necessary for court proceedings concerning the individual. Section 12(2)(c) also disapplies it where the processing concerns a child of thirteen years or older requesting information or a service by electronic means at the child's own specific request.
The Act defines no separate category of sensitive personal data, so section 12's heightened consent rule for children and individuals lacking capacity is the only special-category protection this Act states. By a notice under section 2, the Minister appointed as the day the Act came into force.
When LexLint raises it
When your app profile says your app serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .