KiribatiData Protection Act 2025, personal data breaches
Data Protection Act 2025, ss. 19-20 (personal data breaches)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify the Digital Transformation Office of a personal data breach that has resulted in, or is likely to result in, significant harm to affected data subjects, as soon as practicable after becoming aware of the breach.NIST Privacy FrameworkCM.AW-P7
- Notify each affected data subject of that same harmful personal data breach as soon as practicable after becoming aware of the breach, or by public notification through widely used media where direct notification is not feasible or would involve disproportionate effort or expense.NIST Privacy FrameworkCM.AW-P7
- Describe in the notification the nature of the breach including, where possible, the categories and approximate numbers of data subjects and personal data records concerned, a point of contact, the likely consequences, and the measures taken or expected to address the breach and mitigate its effects, supplying information in phases without undue further delay where it cannot all be given at once.NIST Privacy FrameworkCM.AW-P7
- As a person processing personal data on another person's behalf, inform that other person as soon as practicable after becoming aware of any personal data breach, regardless of whether it meets the significant-harm threshold for notifying the Office and data subjects.NIST Privacy FrameworkCM.AW-P7
- Keep a record of every personal data breach, regardless of whether it meets that threshold, including the facts, its effects and the remedial action taken, and make your threshold analysis available to the Office on request.NIST Privacy FrameworkPR.PO-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 19(3) makes each person that processes personal data keep a record of every personal data breach, whether or not it must be notified, covering the facts, the effects and the remedial action taken, in a manner that lets the Office verify compliance. Section 19(4) makes the controller keep a written record of its analysis of whether each breach meets the harm test in section 20(1) and make it available to the Office on request. The sections name no period for keeping the record, so no retention is coded. Section 20 adds the duty to notify the Office and the affected individuals, which is a report and not a record. Neither section has a scope clause. The Kiribati copy cited is the Clerk's certified printed copy of the Bill as passed by the Maneaba ni Maungatabu on , with the Act number, the assent and the commencement date left blank, so the wording is that of the passed Bill and the gazetted Act has not been compared with it.
- Kind
- Explicit
- As of
- Provision
- Section 19(3) and (4) (a record of every personal data breach, and a written record of the controller's analysis of whether it is a harmful breach)
- Trigger
- security_incident
What this law does
Section 19(1) requires a person processing personal data on another person's behalf to inform that other person as soon as practicable after becoming aware of any personal data breach, whether or not it meets the harm threshold in section 20, and section 19(3) requires every person to keep a record of any personal data breach, including its facts, effects and remedial action, whether or not that threshold is met.
Section 19(4) requires a controller to determine whether a breach meets the section 20(1) threshold, keep a written record of that analysis, and make it available to the Office on request.
Section 20 applies to a personal data breach that has resulted in, or is likely to result in, significant harm to affected data subjects, assessed against factors including encryption or other security measures, the nature of the likely harm, mitigating action taken, and whether lost or altered data has been recovered.
When a harmful personal data breach has occurred, section 20(2) requires the relevant controller, as soon as practicable after becoming aware of the breach, to notify the Office and each affected data subject, or to notify data subjects by public notification through widely used media where direct notification would involve disproportionate effort or expense or is otherwise not feasible.
Section 20(5) requires the notification to set out the nature of the breach including, where possible, the categories and approximate numbers of data subjects and records concerned, a point of contact, the likely consequences, and the measures taken or expected to address the breach, supplying the information in phases without undue further delay where it cannot all be given at once. By a notice under section 2, the Minister appointed as the day the Act came into force.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .