KiribatiData Protection Act 2025, enforcement, offences and civil remedies
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Attend at the time and place the Digital Transformation Office sets, produce the document, record or article it requires, or furnish a written statement under oath or affirmation, when the Office issues a notice for the purpose of an investigation, and produce or give access to information held on a device in a visible, legible, structured and machine-readable form when the Office requires it.
- Comply with a notice the Office issues after investigation requiring you, within a specified period, to stop or refrain from the violating act, compel a downstream processor to do the same, remedy the violation including compensating an affected data subject, or pay an administrative penalty of up to $100,000, proportionate to the violation's gravity, your efforts to comply, any profit made, and the harm caused.
- Comply with any notice the Office issues under section 27 or 28, unless it is the subject of a duly made and ongoing appeal under section 30.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Failing to comply with a notice issued under sections 27 or 28 is an offence carrying a fine not exceeding $100,000 and a term of imprisonment not exceeding 10 years, or both (s. 29(1)). The bill print read $20,000; the Act print reads $100,000. No offence can be committed before commencement.
Penalty structure
The Digital Transformation Office may order an administrative penalty of up to $100,000 for a violation (s. 28(1)(d)); failing to comply with an Office notice is itself an offence carrying a fine of up to $100,000 and imprisonment of up to 10 years, or both (s. 29(1)). Both figures read $20,000 in the bill print this note was first researched from. Kiribati has no currency of its own; the Australian dollar is the currency it uses. In force from .
- Rule
- Fixed only
- As of
- Currency
- AUD
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Digital Transformation Office
Settledness
- As of
- Open questions
- Does the delay in section 6(2) of the Data Protection Act 2025, which holds the Act off a person "domiciled, resident, or operating in Kiribati" that is not a controller of major importance until the second anniversary of commencement, also bar the Office from investigating that person under section 27 or serving a notice under section 28 before that date?
What it reaches
Obligation class
Governance, Reporting
Applicability criteria
Section 6(2) delays the Act until the second anniversary of commencement for a person domiciled, resident or operating in Kiribati that is not a controller of major importance.
- As of
- Combinator
- Any of
- Criteria
- a controller that is domiciled, resident or operating in Kiribati and currently processes, has processed in the last twelve months or expects to process in the next twelve months personal data relating to more than 10,000 data subjects who are within Kiribati
- outside Kiribati if the processing relates to the offering of goods or services to, or the monitoring of behaviour of, data subjects in Kiribati
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 26 to 31 cover complaints, the Office's investigations, its notices, the offences and the civil remedies. Section 27(2)(b) lets the Office issue a notice to produce a document or record relevant to an investigation, and section 27(3)(c) lets an officer holding a warrant search premises and computer systems and seize items. That is a power to demand and inspect, and none of the sections requires a person to make or keep a log or record. The record duties sit in sections 19 and 25, which this row does not cite. The sections have no scope clause. The Kiribati copy cited is the Clerk's certified printed copy of the Bill as passed by the Maneaba ni Maungatabu on , with the Act number, the assent and the commencement date left blank, so the wording is that of the passed Bill and the gazetted Act has not been compared with it.
- Kind
- None
- As of
What this law does
Section 26 lets a data subject aggrieved by a violation of the Act lodge a complaint with the Office, which the Office admits where the complainant has an interest in the matter and the complaint is not frivolous or vexatious.
Section 27 lets the Office investigate on the basis of an admitted complaint or of its own accord where it has reason to believe a person has violated or is likely to violate the Act, with power to require attendance, documents, or a sworn statement, and, on a warrant from the appropriate court, to search premises or computer systems and seize items related to a suspected violation.
Section 28 lets the Office, after completing an investigation, issue a notice requiring a person within a specified period to stop or refrain from the violating act, compel a downstream processor to do the same, remedy the violation including compensating an affected data subject, or pay an administrative penalty not exceeding $100,000, proportionate to the violation's gravity and repetitive nature, the person's efforts to comply, any profits made, and the harm caused.
Section 29(1) makes it an offence, punishable by a fine not exceeding $100,000 and imprisonment not exceeding ten years or both, to fail to comply with a notice issued under section 27 or 28 that is not the subject of a duly made and ongoing appeal.
Section 30 lets an affected data subject, the subject of a section 28 notice, or another interested person apply to the appropriate court for judicial review of the notice within thirty days, and section 31 lets a data subject or a consumer organisation acting on their behalf recover damages in civil proceedings for injury, loss or harm caused by a violation, without duplicating compensation already ordered under a section 28 notice. By a notice under section 2, the Minister appointed as the day the Act came into force.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .