KiribatiData Protection Act 2025, automated decisions
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Do not subject a data subject to a decision based solely on automated processing of personal data that produces a legal or similarly significant effect on them, unless the decision is necessary to a contract with them, authorised by a law with suitable safeguards, or authorised by their consent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 17 gives the right not to be subject to a decision based solely on automated processing with legal or similar significant effects, and lists three exceptions (contract, authorisation by written law, consent). It asks for no safeguard beyond the exception's own condition and names no log, record of the decision or its basis, and no reader. The section has no scope clause. The Kiribati copy cited is the Clerk's certified printed copy of the Bill as passed by the Maneaba ni Maungatabu on , with the Act number, the assent and the commencement date left blank, so the wording is that of the passed Bill and the gazetted Act has not been compared with it.
- Kind
- None
- As of
What this law does
Section 2 leaves commencement to a ministerial notice. By a notice under section 2, the Minister appointed as the day the Act came into force. Section 17 gives a data subject the right not to be subject to a decision based solely on automated processing of personal data that produces a legal or similarly significant effect on them, except where the decision is necessary to a contract with them, authorised by a written law with suitable safeguards, or authorised by their consent.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .