MaldivesPersonal Data Protection Bill, pending before the People's Majlis
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Consent, Security, Retention, Governance
- Audit expectation
- none
What it requires
- A Controller or Processor needs a lawful basis before processing personal data, must collect it only for specific, explicit and legitimate purposes declared before collection, and must not process it further in a way incompatible with those purposes.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P1
- Personal data must be adequate, relevant and necessary to the declared purposes, accurate and kept up to date, and retained in identifiable form no longer than those purposes need.NIST Privacy FrameworkGV.PO-P1
- A Controller or Processor must secure personal data with appropriate technical, physical or organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or damage.NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the exclusion in section 3(b)(1) of "an organization in the course of acting on behalf of a public agency" take a private processor that works for a public agency outside the Bill's duties for that work?
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Section 31(e) and (f) says the activities Controllers and Processors carry out should be recorded and filed, and sets a minimum for that record: the categories of personal data and of data subjects, who the data is shared with (including across borders), and the collection, processing and retention process with its timeframe. Section 31 is introduced as organizational measures the Data Protection Authority may issue, and the drafting is 'should', so the duty is stated softly. None of the record contents is an event-log field. Section 19(a) separately requires a Controller relying on consent to be able to demonstrate it, which implies a record of the consent. Section 31 and the rest of the row name nobody who may demand the record, and no retention period for it, so the audit and access keys are empty. The territorial hook comes from section 3(a): an establishment test (formed or recognized under Maldivian law, or maintaining an authority, branch or agency there), an offering of goods or services to data subjects in the Maldives, and monitoring of behavior that takes place there. The prong that turns on processing equipment located in the Maldives and the reference to citizens are not hook values and are left out.
- Kind
- Explicit
- As of
- Provision
- Section 31(e)-(f) (record of processing activities), with section 19(a) (demonstrating consent)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Section 3 would apply the Bill to the processing of all types of personal data by a Controller or Processor in both the public and private sectors within the Maldives, including processing equipment located there and anyone maintaining an Authority, branch or agency there, and to the processing of the personal data of data subjects located in the Maldives.
Chapter 2 would establish a Data Protection Authority, regulated as a part of the National Center for Information Technology and responsible for the administration and enforcement of the Bill. A news report on the submitted Bill instead describes a Privacy Commissioner whose functions the Information Commissioner appointed under the Right to Information Act would carry out.
Section 14 would set the principles: collection for specific, explicit and legitimate purposes declared before collection and no further processing incompatible with them, lawful, impartial and transparent processing, data adequate, relevant and necessary to those purposes, data accurate and kept up to date with inaccurate or outdated data erased or rectified without delay, retention in identifiable form no longer than the purpose needs, and processing that ensures appropriate security against unauthorized or unlawful processing and against accidental loss, destruction or damage using appropriate technical, physical or organizational measures.
Chapter 5 would carry the security duties and chapter 10 the miscellaneous provisions, including technological neutrality and the definitions the rest of the Bill turns on. The Bill's own text carries no Act number and no record of ratification or gazette publication. The Bill was submitted to the People's Majlis on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .