MaldivesMaldives Personal Data Protection Bill, investigation, enforcement and compensation
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Allow the Data Protection Authority, when it investigates a complaint, to enter premises to search, to search and copy documents and to interview personnel; where the owner of the premises refuses a search, it is carried out with a court order.
- Stop processing personal data when the Data Protection Authority orders it, temporarily or permanently, because it determines that sharing personal data across borders is a threat to national security or the stability of society.
- A Controller or Processor bears responsibility for damage caused by its breach of the law, and every person has a right to compensation for that damage.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Chapter 9 gives the Data Protection Authority powers to investigate a complaint: enter premises, search the entity's documents and copy them, interview personnel, and carry out a search under a court order where the owner refuses (section 47(d)-(e)). It sets no duty on a Controller or Processor to keep a log or register. Section 47(c) says records related to an investigation should be retained for at least five years, which is the Authority's own file of its investigation, not a record the regulated party keeps, so no retention is coded. Because the Authority may search and copy documents when it chooses, the audit expectation is on request by the regulator. Sections 48 to 55 (review, instructions, correctional powers, orders, exemptions, penalties and compensation) add no record duty.
- Kind
- None
- As of
What this law does
Section 46 would give any person the right to lodge a complaint with the Data Protection Authority about an alleged infringement of their rights, and section 47 would give the Authority the right to investigate, including to enter premises, search and copy documents and interview people, while letting it halt, suspend or decline an investigation in the cases it lists and requiring investigation records to be kept for at least five years.
Section 52 would let the Authority order processing to stop temporarily or permanently where it determines that sharing personal data across borders threatens national security or the stability of society, and section 53 would let it exempt a person or category from part of the Act.
Section 54 would require the Authority to impose administrative penalties including fines, on top of any other sanction, weighing the nature, scope and duration of the conduct and the harm caused, whether it was intentional or negligent, the steps taken to mitigate it, the responsibility assumed, any prior breaches, the degree of cooperation, the categories of data and groups affected, the timeliness and completeness of the notifications made, any previous enforcement, and the financial impact.
Section 55 would give every person a right to compensation for damage caused by a breach of the Act. The Bill's own text carries no Act number and no record of ratification or gazette publication. The Bill was submitted to the People's Majlis on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .