Marshall IslandsPersonal Data Protection Act 2025, competent authority, remedies, and complaints
Personal Data Protection Act 2025, ss. 406-408, 410-414, 416-417 (6 MIRC Ch. 4, P.L. 2025-43)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://www.rmiparliament.org/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0043/2025-0043_1.pdfIn force since .
An enforcement supervision rule binding government bodies.
- Criminal exposure
- No
- Private right of action
- Yes
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Maintain confidentiality of personal data obtained while performing duties for the competent authority, if engaged by it as a director, employee, or consultant.NIST Privacy FrameworkPR.PO-P9
- Provide the competent authority, the Economic Policy, Planning and Statistics Office, with information it requests as needed for it to carry out its duties under this Chapter.NIST Privacy FrameworkGV.PO-P5
- Compile and record, for each calendar year, the policies, decisions and actions taken to implement this Chapter and the complaints received about it, including how many were received, which principles they alleged were contravened, and how they were resolved.NIST Privacy FrameworkGV.MT-P7
- Report that information to the competent authority by July 1 of each year, in anonymized form for its statistical and Nitijela reporting.NIST Privacy FrameworkGV.MT-P4
- Establish a process for natural persons residing in the Republic to submit complaints about alleged violations of the personal data protection principles, consistent with any guidance the competent authority adopts, and retain records of the complaints and any action taken.NIST Privacy FrameworkGV.MT-P7
- Expect a natural person residing in the Republic who is injured by improper administration of this Chapter to be able to sue for an injunction, mandamus, a corrective order, or a public statement of remedy, though not for compensatory damages against the ministry or agency itself.
- Expect a natural person to be able to separately sue an employee personally, including for compensatory damages against the employee, for willful or grossly negligent conduct that causes such an injury.
- Comply with any regulation the competent authority makes, with Cabinet approval, to implement this Chapter.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- GV.MT-P4Policies, processes, and procedures for communicating progress on managing privacy risks are established and in place.
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Economic Policy, Planning and Statistics Office (EPSSO), the competent authority that administers the Chapter; a court hears a suit against a core Government ministry or agency under section 410.
Settledness
- As of
- Open questions
- Does the proviso in section 410(2) of the Personal Data Protection Act 2025, that compensatory relief 'shall be imposed against a core ministry or agency pursuant to section 411(2)', a section that bars a court from awarding compensatory relief against a ministry or agency, leave a natural person any compensatory damages claim against a public service employee in the employee's personal capacity?
What it reaches
Obligation class
Governance, Reporting
Applicability criteria
Section 405 defines core Government ministries and agencies as national executive branch ministries, departments, divisions, bureaus, offices and any other agency of the Republic, and reaches a third party acting on behalf of one as a data controller or data processor.
- As of
- Combinator
- Any of
- Criteria
- core Government ministries and agencies that may collect, use, store, process, disclose, or transfer personal data of natural persons in the Republic
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 413(1) requires each core Government ministry and agency to compile and record, for each calendar year, the policies, decisions and actions taken to implement the Chapter and the complaints received, with their number, the principles alleged to be breached and how each was resolved. Section 414(4) requires it to retain records on submitted complaints and on determinations or actions on matters short of a complaint, for the annual report. The recorded items are counts and narrative and match no log-content value. Section 413(2) has the ministry or agency report the information to the competent authority by July 1 each year, and section 413(3) limits the authority to anonymized statistical and Nitijela reporting use. A ministry's own annual report is not an audit; the authority's power to require information (section 407(e)) is the check, so an on-request regulator expectation is coded. Section 414(4) states no retention period. Section 410's reference to persons residing in the Republic identifies who may sue and is not a territorial test for the Chapter.
- Kind
- Explicit
- As of
- Provision
- Sections 413(1) and 414(4)
- Trigger
- personal_data_processing
What this law does
Section 406 designates the Economic Policy, Planning and Statistics Office (EPSSO) as the competent authority responsible for administering this Chapter, and section 407 gives it power to develop guidance and capacity-building initiatives, coordinate data sharing among ministries and agencies, require information from them as needed to comply with this Chapter, and make rules or regulations for its implementation.
Section 408 requires any director, employee, consultant, or other person engaged by the competent authority under this Chapter to maintain confidentiality of personal data obtained in the performance of their duties.
Section 410 lets a natural person residing in the Republic who suffers an injury from a core Government ministry's or agency's alleged improper administration of the Chapter bring suit against that ministry or agency, and separately lets that person sue an employee of the public service personally, in the employee's own capacity, for willful or grossly negligent conduct causing the injury, including for compensatory damages against the employee.
Section 411 lists the remedies a court may impose on the ministry or agency itself, an injunction, mandamus, a corrective order, or a public statement of remedy, but bars a court from awarding compensatory relief against the ministry or agency itself. Section 412 requires the competent authority to report yearly to the Minister for presentation to the Nitijela on this Chapter's implementation.
Section 413 requires core Government ministries and agencies to compile and record each calendar year the policies and actions taken to implement the Chapter and the complaints received, and to report that information to the competent authority by July 1 of each year in anonymized form.
Section 414 requires each ministry and agency to establish a process for a natural person residing in the Republic to submit a complaint about an alleged violation, consistent with the competent authority's guidance. Section 417 lets the competent authority, with Cabinet approval, make regulations for the Chapter's effective performance. The Chapter states no penalty or offence provision of its own.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .