KiribatiData Protection Act 2025, rights of a data subject
Data Protection Act 2025, ss. 13, 15-16 (information notice and rights of data subjects)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Tell a data subject before collecting their personal data who the controller is and how to contact them, the purpose of the processing, how to exercise their Part IV rights, and how to lodge a complaint with the Digital Transformation Office, and give that information as soon as possible afterward where it could not be given beforehand.NIST Privacy FrameworkCM.AW-P1
- Give a data subject, at no expense and without unreasonable delay, confirmation of whether their personal data is being processed and its source, a copy of it in a commonly used electronic format, correction of data that is inaccurate, out of date, incomplete or misleading, and deletion of data the controller is not entitled to retain.NIST Privacy FrameworkCT.PO-P3
- Let a data subject withdraw consent previously given, or object to processing that rests on voluntary provision with no lawful basis, as easily as they gave it, tell them the consequences of doing so, and promptly stop the processing that relied solely on it.NIST Privacy FrameworkCT.PO-P1
- A manifestly unfounded or excessive request, particularly one that is repetitive, may be met with a reasonable fee or a refusal, and a fee for a copy of personal data may be charged only to the extent another law otherwise permits it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 13, 15 and 16 set the notice a controller gives before collection, the rights of confirmation, access, correction and deletion, and the right to withdraw consent, with the ease-of-withdrawal rule in section 16(2). They require notices, copies and prompt cessation of processing, and none requires the controller to keep a log, a register or a record of a request or of consent. Section 15(3) lets a controller ask for evidence of the accuracy of a correction, which is a condition on the data subject's request. The sections have no scope clause. The Kiribati copy cited is the Clerk's certified printed copy of the Bill as passed by the Maneaba ni Maungatabu on , with the Act number, the assent and the commencement date left blank, so the wording is that of the passed Bill and the gazetted Act has not been compared with it.
- Kind
- None
- As of
What this law does
Section 13 requires a controller to tell a data subject, before collecting personal data from them, the controller's identity and contact details, the purpose of the processing, how to exercise the Part IV rights, and how to lodge a complaint with the Office under section 26, and to give that information as soon as possible afterward if it could not be given at collection.
Section 15 gives a data subject the right to obtain from a controller, at no expense and without unreasonable delay, confirmation of whether the controller is processing their personal data, a copy of it in a commonly used electronic format, correction of data that is inaccurate, out of date, incomplete or misleading, and deletion of data the controller is not entitled to retain.
Section 15(2) lets a controller charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, particularly because of its repetitive character, and section 15(4) lets a controller charge a fee for a copy of personal data only to the extent another applicable law otherwise permits.
Section 16 gives a data subject the right to withdraw consent previously given, or to object where no lawful basis applies, requires a controller to make exercising that right as easy as giving consent, and requires the controller to promptly stop processing that relies solely on the withdrawn consent. By a notice under section 2, the Minister appointed as the day the Act came into force.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .