SurinameDraft Law on the Protection of Privacy and Personal Data (Ontwerpwet Bescherming Privacy en Persoonsgegevens)
Wet Bescherming Privacy en Persoonsgegevens, arts. 1-6, 12, 14-19, 21 (general obligations)
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Consent, Governance, Security, Retention
- Audit expectation
- none
What it requires
- Have a lawful basis, such as a contract, a legal obligation, vital interests, a public interest task, official authority, a legitimate interest that does not override the data subject's rights, or the data subject's consent, before processing personal data.NIST Privacy FrameworkCT.PO-P1
- Where processing rests on consent, present the request separately from other matters, in clear and simple language, and let the data subject withdraw consent as easily as it was given.NIST Privacy FrameworkCT.PO-P1
- Process personal data lawfully and fairly, only for specified, explicit and legitimate purposes, and keep it adequate, relevant, accurate, and limited to what those purposes need.NIST Privacy FrameworkGV.PO-P1
- Do not keep personal data in a form that identifies a data subject for longer than the processing purposes require.NIST Privacy FrameworkCT.DM-P5
- Take appropriate technical and organizational measures so you can demonstrate compliance with this law on request, and require anyone with access to personal data under your authority to keep it confidential or be bound by a legal duty of confidentiality.NIST Privacy FrameworkGV.MT-P3NIST Privacy FrameworkPR.PO-P9
- Implement data protection by design and by default, taking into account the state of the art, the cost of implementation, and the risks the processing poses to data subjects' rights and freedoms.NIST Privacy FrameworkGV.PO-P2
- Keep a written or electronic register of your processing activities, covering the categories of data, recipients, retention periods, and security measures, and notify it to the Commissioner for Personal Data Protection, updating the notification whenever needed and at least once a year.NIST Privacy FrameworkID.IM-P4NIST Privacy FrameworkGV.PO-P5
- Take appropriate technical and organizational security measures against accidental or unauthorized access, destruction, loss, use, alteration, or disclosure of personal data, matched to the risk.NIST Privacy FrameworkPR.DS-P5
- Appoint a data protection officer to advise you and your staff on this law's duties, liaise with the Commissioner, and act as the contact point for data subjects exercising their rights.NIST Privacy FrameworkGV.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
4 more
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 18 makes every controller (and every processor, for its processing on a controller's behalf) keep a register of its processing activities, in writing or electronic form (18(3)), and notify it to the Commissioner for Personal Data Protection, updating the notification when needed and at least once a year (18(4)). The register states the controller's identity, the purposes, the categories of data subjects and data, the recipients including third-country recipients and the legal basis for the transfer, the intended erasure periods where possible, and a general description of the security measures. Those are not log fields. The article sets no period for keeping the register. The annual notification is the party's own filing and not an audit, and no article the row cites lets the Commissioner demand or inspect records, so the expectation is none; the Commissioner's investigative powers are article 32, which is outside the articles this row cites and sits on the enforcement row. The duty to be able to demonstrate compliance (article 14(1)) names no requester and is not applied. Article 3(2)(c) reaches a controller that uses equipment located in Suriname, a prong that turns on where the means are located. The text is a draft bill.
- Kind
- Explicit
- As of
- Provision
- Article 18(1)-(4)
- Trigger
- personal_data_processing
What this law does
The draft bill defines privacy as the right to protection of all information about an identified or identifiable living natural person, and defines personal data the same way, an identifiable natural person being one who can be identified directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity.
Article 5 sets out the processing principles: lawfulness and fairness, openness and transparency, purpose limitation and data minimization, data quality, storage limitation, security safeguards, data-subject participation, ethical processing, and accountability.
Article 6 requires a lawful basis before processing, running from contractual necessity, a legal obligation, vital interests, a public-interest task, and official authority through to a legitimate interest that does not override the data subject's rights, or the data subject's own specific, informed consent presented separately from other matters and withdrawable at any time.
Article 12 lets specific laws narrow the rights and obligations in article 5, chapter III, and article 20(5) for purposes including national security, defence, public safety, and the prevention, investigation, detection or prosecution of criminal offences. Article 14 requires a controller and, where applicable, a processor to take appropriate technical and organizational measures able to demonstrate compliance on request, and to bind anyone with access to personal data to confidentiality.
Article 15 requires data protection by design and by default under article 17, a written processor contract, and cooperation between joint controllers. Article 18 requires a controller and processor to keep a register of processing activities and notify it to the Commissioner for Personal Data Protection, updated whenever needed and at least once a year. Article 19 requires appropriate technical and organizational security measures matched to the risk.
Article 21 requires a controller and a processor each to appoint a data protection officer to advise on this law's duties, liaise with the Commissioner, and act as the contact point for a data subject exercising their rights. The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .