KiribatiData Protection Act 2025, processing and transfers outside Kiribati
Data Protection Act 2025, ss. 23-25 (processing and transfers outside Kiribati)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Before processing personal data outside Kiribati or transferring it to a person outside Kiribati, take reasonable steps to verify that the recipient jurisdiction affords adequate protection, meaning restrictions and obligations substantially similar to Parts III and V, rights substantially similar to Part IV, and that those restrictions, obligations and rights are substantially enforceable.
- Where adequate protection cannot be verified, transfer or process personal data outside Kiribati only on another listed basis, such as the data subject's informed consent to the transfer, contractual necessity, a medical emergency, a transfer for the data subject's benefit where consent is impracticable but would likely be given, or a transfer under an international agreement such as a mutual legal assistance treaty.
- Comply with any prohibition, designation or guideline the Digital Transformation Office issues on whether a jurisdiction, organisation, law or measure affords adequate protection, and with any Office prohibition on transferring personal data to a specified jurisdiction, organisation or under specified measures for want of adequate protection or for reasons of national security.
- Keep a written record of the reasonable steps taken to verify adequate protection or the alternative basis relied on for processing or transferring personal data outside Kiribati, and make that record available to the Office on request.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 25 makes a person that processes personal data outside Kiribati or transfers it to a person outside Kiribati keep a written record of the adequacy steps it took or the section 24 basis it relied on, and make the record available to the Office on request. The section names no contents beyond the steps or bases, and no period for keeping the record, so no log contents and no retention are coded. Sections 23 and 24 set the adequacy test and the other bases and carry no record duty of their own. The Part reaches a person by where the processing or the receiving party sits, a test of the place of processing, and the Act's own territorial clause is section 5, which the row does not cite, so no hook is coded. The Kiribati copy cited is the Clerk's certified printed copy of the Bill as passed by the Maneaba ni Maungatabu on , with the Act number, the assent and the commencement date left blank, so the wording is that of the passed Bill and the gazetted Act has not been compared with it.
- Kind
- Explicit
- As of
- Provision
- Section 25 (a written record of the reasonable steps taken under section 23(1) or the bases relied on under section 24)
- Trigger
- personal_data_processing
What this law does
Section 23(1) requires a person that processes personal data outside Kiribati or transfers it to a person outside Kiribati to take reasonable steps to verify or ensure that there is adequate protection with respect to the personal data.
Section 23(2) defines adequate protection as restrictions and obligations substantially similar to Parts III and V, rights substantially similar to Part IV, and enforceability of those restrictions, obligations and rights, and section 23(3) lets that protection rest on the destination jurisdiction's laws, on binding corporate rules, contractual clauses, a code of conduct or a certification mechanism, or on an international organisation's own policies and measures.
Section 23(4) lets the Office issue guidelines on assessing adequate protection and designate a jurisdiction, organisation, law, or measure as affording or not affording it, and section 23(6) lets the Office prohibit a transfer to a specified jurisdiction, organisation or under specified measures for want of adequate protection or for reasons of national security.
Section 24 lets a person process or transfer personal data outside Kiribati without adequate protection where the data subject has given informed consent to the transfer, the transfer is necessary to a contract with the data subject or to a medical emergency, the transfer is for the data subject's benefit and consent is impracticable but would likely be given, or the transfer follows a court or administrative order under an international agreement such as a mutual legal assistance treaty.
Section 25 requires a person processing or transferring personal data outside Kiribati to keep a written record of the reasonable steps taken under section 23(1) or the basis relied on under section 24, and to make that record available to the Office on request. By a notice under section 2, the Minister appointed as the day the Act came into force.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .