MaldivesMaldives Personal Data Protection Bill, personal data breach notification
Personal Data Protection Bill, section 34 (personal data breach notification)
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- A Controller must notify the Data Protection Authority within 72 hours of coming to know of, or reasonably believing in, a personal data breach involving special categories of personal data or data that could enable identity theft or fraud.
- The same section requires the affected data subjects to be told, on the same seventy-two-hour period and on the same trigger.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 34 requires a Controller to notify the Data Protection Authority, and affected data subjects, within 72 hours of a reasonable belief that a breach occurred, and section 35 sets the minimum content of the notice. It does not tell the Controller to keep a breach register or document breaches that are not notified, so it states no record duty. Section 34(b) lets the Authority investigate where there is a delay or failure to notify, including by on-site examination of systems and procedures, which is a power exercised when the Authority chooses, so the audit expectation is on request by the regulator.
- Kind
- None
- As of
What this law does
Section 34(a) would require the Controller to notify both the Data Protection Authority and the affected data subjects within seventy-two hours upon knowledge of, or a reasonable belief in, a personal data breach, where the breach involves special categories of personal data or any personal data that could be used to enable identity theft or fraud and the further elements the section lists are present.
The same subsection restates the duty to the Authority alone in the same terms and on the same seventy-two-hour period, counted from the receipt of knowledge of or a reasonable belief that a breach has occurred. The Bill's own text carries no Act number and no record of ratification or gazette publication. The Bill was submitted to the People's Majlis on .
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .