San MarinoSan Marino Law No. 171 on the Protection of Natural Persons
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Consent, Security, DPIA, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a lawful basis before processing personal data of a person in San Marino under Law 171/2018.NIST Privacy FrameworkCT.PO-P1
- Take consent only where you can demonstrate the data subject gave it, and for an information society service offered to a child, only on the terms article 7 sets.NIST Privacy FrameworkCT.PO-P1
- Build data protection into the design of your processing and make it the default, and keep records of your processing activities.NIST Privacy FrameworkGV.PO-P2NIST Privacy FrameworkID.IM-P4
- Implement technical and organisational measures giving a level of security appropriate to the risk, and cooperate with the Data Protection Authority in the performance of its tasks.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkGV.PO-P5
- Carry out a data protection impact assessment before processing likely to result in a high risk, and consult the Data Protection Authority beforehand where the assessment shows that risk remains.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.PO-P5
- Designate a data protection officer where the law requires one, give them the position article 39 prescribes, and let them carry out the tasks article 40 lists.NIST Privacy FrameworkGV.PO-P3
- Where you engage a processor, govern the engagement as article 29 requires, and settle each party's responsibilities in an arrangement where you are a joint controller.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkGV.PO-P4
These lines are LexLint's reading of the law's text. Also read by: Autorità Garante per la protezione dei dati personali (the data protection authority of San Marino), decision no. 19 of applying Article 33 of Law 171/2018 (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P4Privacy roles and responsibilities are coordinated and aligned with third-party stakeholders (e.g., service providers, customers, partners).
3 more
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.garanteprivacy.sm/pub1/garante/dam/jcr:9bbee866-f4b6-48c9-99dd-b10ef3b39ceb/Provvedimento%20n.%2019%20del%206%20luglio%202021%20-%20Mancata%20adozione%20misure%20di%20sicurezza%20-%20Ingiunzione.pdf
- Guidance body
- Autorità Garante per la protezione dei dati personali (the data protection authority of San Marino), decision no. 19 of applying Article 33 of Law 171/2018
- Open questions
- Beyond the three cases in Article 36, paragraph 3, which types of processing fall within the 'valutazione d’impatto sulla protezione dei dati' (data protection impact assessment) requirement, given that paragraph 4 leaves the list of those types to the Autorità Garante to 'redige e rende pubblico' (draw up and make public)?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 31 requires every controller to keep a written register of its processing activities, and every processor a register of the processing it carries out for a controller, and to make the register available to the Autorità Garante on request. Article 34(5), inside the cited range, requires the controller to document every personal data breach so that the Authority can verify compliance, and Article 6(1) requires the controller to be able to demonstrate that the data subject consented. The register's contents (purposes, categories of data subjects and data, recipients, transfers, erasure time limits, security measures) are outside the closed list of log contents, so the only listed value is the consent state. Article 31(5) exempts organisations with fewer than 250 employees unless the processing is risky, is not occasional or covers special-category or criminal-offence data. Article 29(3)(h) lets a controller audit its processor and Article 36(9) requires a review of an impact assessment when the risk changes; neither fixes a cadence, so the audit is coded on the Authority's power to ask for the register. Article 3(2) reaches processing by a controller or processor outside San Marino for goods or services offered to, or behavior monitored in, San Marino. Retention clauses on traffic data sit outside the cited range in the same Law: Article 112(2) allows billing traffic data to be kept for up to six months, Article 121(1) requires telephone traffic data to be kept 24 months and internet traffic data 12 months for the detection and prosecution of crime, Article 121(2) sets 30 days for unanswered calls, and Article 121(4) lets the Garante order preservation of internet traffic data for up to 90 days, extendable to six months.
- Kind
- Explicit
- As of
- Provision
- Article 31 (register of processing activities), with Article 34(5) (documentation of every personal data breach) and Article 6(1) (demonstrable consent)
- Trigger
- personal_data_processing
- security_incident
- consent_or_optout
What this law does
Article 3 fixes the law's territorial and material scope. Article 4 carries the processing principles and article 5 the lawful bases, while article 6 sets the conditions for valid consent and article 7 the conditions for a child's consent to an information society service. Articles 10 and 11 govern data on criminal convictions and processing that does not require identification.
Article 26 places responsibility for compliance on the controller, article 27 requires data protection by design and by default, article 28 governs joint controllers, article 29 the engagement of a processor and article 30 processing under the authority of either. Article 31 requires records of processing activities and article 32 cooperation with the Data Protection Authority. Article 33 requires technical and organisational measures giving a level of security appropriate to the risk.
Article 36 requires a data protection impact assessment where processing is likely to result in a high risk, and article 37 prior consultation of the Authority where the assessment shows that risk. Articles 38 to 40 govern the designation, position and tasks of the data protection officer, and articles 41 to 44 the codes of conduct, their monitoring, certification and certification bodies.
Law 171/2018 was approved by the Great and General Council on and promulgated by the Captains Regent on , the date carried in the law's own official title. Article 129 provides that the law enters into force on the fifteenth day after its legal publication. The Bollettino Ufficiale records its publication on , so the law entered into force on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .