MaldivesMaldives Personal Data Protection Bill, cross-border transfers
Personal Data Protection Bill, chapters 7-8 (personal data transfers and cross-border transfers)
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- on_request
- Who audits it
- Self, Independent third party
- Where the report goes
- Produced on request
What it requires
- A Controller or Processor must not transfer personal data outside the Maldives without appropriate safeguards, and only where enforceable data subject rights and effective legal remedies are available in the destination.
- An agreement with a cross-border recipient must carry a data protection process the Data Protection Authority endorses, or the transfer must rest on binding corporate rules the Authority has approved.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Counterparty, Regulator
Logging duty
A processor contract under section 38 must oblige the Processor to make available to the Controller all information needed to demonstrate compliance and to allow audits and inspections by the Controller or an auditor it mandates (section 38(b)(10)), and section 38(b)(1) ties processing to the Controller's documented instructions. Neither names a log, so the duty rests on demonstrating compliance. Under section 45(10) binding corporate rules, which the Authority may approve as a transfer safeguard, must provide for data protection audits within the group, with results available on request to the Authority. Section 45(11) adds a mechanism for recording changes to the rules and reporting them to the Authority. Nothing in the cited chapters names a log content from the vocabulary or sets a retention period. The chapters carry no scope clause, so there is no territorial hook.
- Kind
- Implicit
- As of
- Provision
- Section 38(b)(10) (processor to demonstrate compliance and allow audits), with section 45(10) (binding corporate rules verification)
- Trigger
- personal_data_processing
What this law does
Section 43 would require a cross-border data transfer by a Controller to be carried out on the conditions the Act specifies.
Section 44 would let a Controller or Processor transfer personal data to a jurisdiction outside the Maldives only where it has provided appropriate safeguards, and only on condition that enforceable data subject rights and effective legal remedies are available there; the safeguards would be the corporate process the Bill describes and an agreement with the receiving entity carrying a data protection process the Data Protection Authority endorses, with the Authority formulating the process by regulation.
Section 45 would let the Authority approve binding corporate rules and fixes what they must specify, including the structure and contact details of the group, the transfers and categories of data concerned, and their legally binding nature. The Bill's own text carries no Act number and no record of ratification or gazette publication. The Bill was submitted to the People's Majlis on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .