LexLint.ioBeta

Know the law your code answers to.

Law / Timor-Leste

Constitution of the Democratic Republic of Timor-Leste, Section 38(2) (Personal data deferred to statute)

Constitution of the Democratic Republic of Timor-Leste (2002), Section 38(2)

In force since .

A comprehensive regime rule binding public and private bodies.

Obligation class
Governance
Audit expectation
none

What it requires

  • Treat Timor-Leste as having no personal-data-protection statute: the Constitution defers the concept of personal data and the general conditions for processing it to a law that has never been enacted, so there is no defined scope, no registration duty, no supervisory authority and no procedure to comply with.
  • Rely on Section 38's own two operative rules, the access right and the sensitive-category consent bar, rather than on a statutory definition of personal data, because none exists to scope a Timor-Leste deployment against.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
  • CT.DM-P1Data elements can be accessed for review.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

Who enforces it

Settledness

As of
Open questions
  • What is the 'concept of personal data' that Section 38(2) of the Constitution of Timor-Leste leaves to the law, for deciding whether the access right in Section 38(1) and the consent rule in Section 38(3) reach a developer's data?
  • Does 'Every citizen' in Section 38(1) of the Constitution of Timor-Leste leave a non-citizen without the access right, and does the right bind a private operator as well as the State?

What it makes you log

Logging duty

Section 38(2) leaves the concept of personal data and the conditions for processing it to a law, and itself requires no log, register or record. The section has no territorial or other scope clause.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 38(2) defers the concept of personal data, and the conditions applicable to processing it generally, to a law that Timor-Leste has never enacted. There is therefore no statutory definition of personal data, no lawful-basis scheme, no registration duty, no supervisory authority and no procedural mechanism behind the two operative rules Section 38 does state.

Adjacent Section 36 (honour and privacy) and Section 37 (inviolability of home and correspondence) protect related interests but create no personal-data-specific duty.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .