MaldivesMaldives Personal Data Protection Bill, rights of data subjects
Personal Data Protection Bill, chapter 4 (rights of data subjects)
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- A Controller must tell a data subject about the processing of their personal data and answer a request to access it, correct it, erase it, restrict its processing, receive it in a portable form, or object to the processing.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Chapter 4 makes a Controller write down its refusals of data subject requests: it documents the nature of an objection and the reasons it was denied (section 24(a)), documents a denied rectification request (section 25(d)), records in writing the nature of and reasons for a rejected restriction request (section 27(b)-(c)) and keeps a written record of decisions rejecting erasure requests (section 28(c)). The drafting is 'should' in places. The record holds the request and the reasons for the refusal, none of which is an event-log field, so the contents list is empty. The chapter names no one who may inspect these records, no audit and no retention period. The chapter has no scope clause, so there is no territorial hook.
- Kind
- Explicit
- As of
- Provision
- Sections 24(a), 25(d), 27(b)-(c) and 28(c) (written record of refused data subject requests)
- Trigger
- personal_data_processing
What this law does
Chapter 4 would carry the rights of data subjects, opening on the general provisions that govern how they are exercised and running through the right to be informed about the processing, to obtain access to the personal data held, to have it corrected where it is inaccurate or incomplete, to have it erased, to restrict its processing, to receive it in a portable form, and to object to processing including profiling.
Section 55 would give every person a right to compensation for damage caused by a breach of the Act, which the enforcement row carries. The Bill's own text carries no Act number and no record of ratification or gazette publication. The Bill was submitted to the People's Majlis on .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .