Marshall IslandsPersonal Data Protection Act 2025, government personal-data protection principles
Personal Data Protection Act 2025, 6 MIRC Ch. 4 (P.L. 2025-43), ss. 401-405, 409, 415, 418
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.rmiparliament.org/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0043/2025-0043_1.pdfIn force since .
A comprehensive regime rule binding government bodies.
- Obligation class
- Governance, Retention, Security, Disclosure
- Audit expectation
- none
What it requires
- This Chapter binds only core Government ministries and agencies, and a third party acting as their data controller or processor, not a private-sector service operating outside a government engagement.
- Process personal data lawfully, fairly, and transparently, for a specified and legitimate purpose, and do not further process it in a way incompatible with that purpose.NIST Privacy FrameworkGV.PO-P1
- Collect personal data only by lawful and fair means, and limit it to what is relevant and necessary to fulfill the purpose for which it is processed.NIST Privacy FrameworkGV.PO-P1
- Keep personal data accurate and up to date, and take reasonable steps to correct or delete inaccurate personal data without delay.NIST Privacy FrameworkCT.PO-P2
- Retain personal data in identifiable form only as long as necessary to fulfill the purpose for which it was collected.NIST Privacy FrameworkCT.PO-P2
- Store or process personal data with technical and organizational security measures that protect against unauthorized or unlawful processing and against unintentional loss, destruction, or damage, and limit access to staff who need it for their duties.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkPR.AC-P4
- Be able to demonstrate compliance with these principles on request of the competent authority, the Economic Policy, Planning and Statistics Office.NIST Privacy FrameworkGV.MT-P3
- Where sharing personal data with another core Government ministry or agency under the safe harbor provision, ensure the sharing serves a legitimate function of each ministry or agency involved and complies with the personal data protection principles.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 409(f) makes the data controller, a core Government ministry or agency, responsible for the principles in Part III and obliges it to demonstrate compliance, which cannot be shown without records of how personal data was handled. The row's other sections (401 to 405, 415 and 418) state no record. The annual compilation of policies and complaints and the retention of complaint records are in sections 413 and 414(4), coded on the competent authority row. Section 403 applies the Chapter to core Government ministries and agencies handling personal data of natural persons in the Republic and states no territorial test, so no hook value applies.
- Kind
- Implicit
- As of
- Provision
- Section 409(f)
- Trigger
- personal_data_processing
What this law does
Sections 401 to 405 apply this Chapter to core Government ministries and agencies of the Republic that collect, use, store, process, disclose, or transfer personal data of natural persons, and their definitions of data controller and data processor extend to a third party acting on behalf of such a ministry or agency; the Chapter excludes processing for law enforcement or national intelligence and national security purposes, non-personal data, and publicly available information lawfully obtained from government records, voluntarily made available by the data subject without audience restriction, or otherwise lawfully obtained, truthful, and a matter of public concern.
Section 409 sets six personal data protection principles binding core Government ministries and agencies: a legitimate-purpose principle requiring lawful, fair, transparent processing for specified purposes; a data-minimization principle limiting collection to what the purpose requires; an accuracy principle requiring inaccurate personal data to be corrected or deleted without delay; a retention principle limiting storage to what the purpose requires; an integrity and security principle requiring technical and organizational protection against unauthorized or unlawful processing and unintentional loss, destruction, or damage, and limiting staff access to what their duties need; and an accountability principle making the data controller responsible for demonstrating compliance.
Section 415 lets core Government ministries and agencies voluntarily share personal data with each other under a safe harbor, provided the sharing serves a legitimate function of each ministry or agency and complies with the section 409 principles, and lets the competent authority set standards for such sharing agreements.
Section 418 states the Chapter takes effect twelve months after the date of its certification under Article IV, section 21 of the Constitution, which the Act's own commencement note records as . The Act states no consent requirement, no data-subject access, correction, deletion, or portability right, no heightened rule for sensitive or biometric data beyond the definition, and no cross-border transfer restriction.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .