Timor-LesteConstitution of Timor-Leste, Section 38(1) (Access to personal data)
Section 38(1) (access), Constitution of Timor-Leste (2002)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Give a Timor-Leste citizen who asks it access to the personal data you hold about them, whether it sits in a computer system or in mechanical or manual records.
- Tell that citizen the purpose of the data you hold about them when they demand it.
- Include a voiceprint or faceprint your service creates in what you disclose, since no statute narrows what counts as personal data for this right.
- Expect no statutory response deadline, fee cap or appeal route, and no supervisory authority: the right is constitutional and its procedure is unlegislated.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DM-P1Data elements can be accessed for review.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 38(1) gives every citizen a right to access personal data held about them in a computer system or in mechanical or manual records and to demand its purpose. It states a right of the citizen and imposes no duty on the holder to keep a log, a register or a record of anything. The right belongs to citizens, a nationality test that carries no hook value, and the section has no territorial or other scope clause.
- Kind
- None
- As of
What this law does
Section 38(1) gives every citizen a right to access personal data about them, whether it is stored in a computer system or entered into mechanical or manual records, and a right to demand the purpose of that data. The right is stated directly in the Constitution and does not wait on the implementing statute Section 38(2) calls for, so it binds on its own terms while its scope stays undefined.
No response deadline, no fee rule, no format requirement and no appeal route is stated, and there is no supervisory authority to complain to. Because no statute defines personal data, a voiceprint or faceprint a service creates is not excluded from what a citizen may ask for.
When LexLint raises it
When your app profile says your app processes biometric data, operates a social platform, reuses other publishers' content or processes personal data.
Back to the example · Lint your app
Page updated .