Saint Kitts and NevisData Protection Act, 2018
Saint Christopher and Nevis Data Protection Act, 2018 (No. 5 of 2018), ss. 1-12, 19 and 21-22
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://lawcommission.gov.kn/wp-content/documents/Annual-Laws/2018/ACTs/Act-5-of-2018-Data-Protection-Act-2018.pdfA comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Disclosure, Security, Retention
- Audit expectation
- none
What it requires
- Obtain a data subject's consent before processing their personal data other than sensitive personal data, unless a listed exception applies.NIST Privacy FrameworkCT.PO-P1
- Before collecting personal data, tell the data subject the purpose of collection, the source of the data where available, the classes of third party it may be disclosed to, whether supplying the data is obligatory or voluntary, and how to request access or correction.NIST Privacy FrameworkCM.AW-P1
- Do not disclose personal data for a new purpose without the data subject's consent, except where crime prevention or detection, legal authorisation, a reasonable belief in a right or in the data subject's consent, or the public interest applies.NIST Privacy FrameworkCT.PO-P2
- Take practical steps to protect personal data from loss, misuse, unauthorised access, alteration or destruction, having regard to the nature of the data, its storage, and the personnel with access to it, and require a data processor you engage to give sufficient security guarantees and comply with them.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkID.DE-P2
- Do not keep personal data longer than the purpose requires, and take reasonable steps to destroy or permanently delete it once no longer needed.NIST Privacy FrameworkCT.DM-P5
- Take reasonable steps to keep personal data accurate, complete, not misleading and up to date.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DM-P5Data are destroyed according to policy.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 7 to 12 set the general, notice and choice, disclosure, security, retention and data integrity principles, section 19 lists when personal data may be disclosed for another purpose, section 21 the exemptions and section 22 the Minister's power to add exemptions. Section 10 asks for practical steps to protect the data and for sufficient guarantees from a processor, and section 11 limits how long the personal data are kept, which limits the data and not a record. None of the sections requires a log, register or record. Section 4(2)(a) applies the Act to a person established in Saint Christopher and Nevis, which is the hook coded. Section 4(2)(b), which reaches a person not established there that uses equipment in the country, turns on where the processing equipment is and is left out. The Act is in the Law Commission text of Act No. 5 of 2018 as published in the Official Gazette on ; the Minister's commencement order was not read.
- Kind
- None
- As of
What this law does
Section 4 applies the Act to a private body processing personal data in respect of commercial transactions, and to any other person meeting a territorial nexus test tied to establishment in Saint Christopher and Nevis or use of equipment there. Section 6 binds the State. Section 7(1) requires a data user to obtain a data subject's consent before processing personal data other than sensitive personal data, or to process sensitive personal data only in accordance with section 20.
Section 7(2) lets a data user process personal data without consent where necessary for a contract, a legal obligation other than a contractual one, the vital interests of the data subject, the administration of justice, or a function conferred by law, and section 7(3) requires the processing to be for a lawful purpose directly related to the data user's activity, necessary for or directly related to that purpose, and adequate but not excessive.
Section 8 requires a data user, on a request for personal data, to tell the data subject the purposes of collection, the source of the data where available, the right to request access and correction, the classes of third party to whom it may be disclosed, and whether supplying the data is obligatory or voluntary.
Section 9 bars disclosure of personal data without the data subject's consent for a purpose other than the one it was collected for or a directly related purpose, or to a class of third party not specified under section 8(d). Section 19 lists the circumstances, including the data subject's consent, crime prevention or detection, legal authorisation, and the public interest, in which such a further disclosure is permitted.
Section 10 requires a data user to take practical steps to protect personal data from loss, misuse, unauthorised access, alteration or destruction, and requires a data processor engaged by the data user to give sufficient security guarantees and to comply with them. Section 11 bars keeping personal data longer than the purpose requires and requires a data user to take reasonable steps to destroy or permanently delete personal data no longer needed.
Section 12 requires a data user to take reasonable steps to keep personal data accurate, complete, not misleading and up to date.
Section 21 exempts personal data processed for an individual's own personal, family or household affairs from the Act entirely, and, subject to listed conditions, exempts data processed for crime prevention or detection, taxation, statistics or research, a court order or judgment, regulatory functions, or journalistic, literary or artistic purposes from some or all of the Act's other principles.
Section 1(2) provides that the Act comes into force on a day fixed by the Minister by Order published in the Gazette, and no commencement order has been located, so the Act's substantive duties are not yet confirmed to be in operation.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .