LexLint.ioBeta

Know the law your code answers to.

Law / Trinidad and Tobago

Data Protection Act, 2011, rights of access and correction

Act 13 of 2011, ss. 52-59 and 75-85 (rights of access and correction)

A data subject rights rule binding public and private bodies.

How the hook was established
express
What makes it apply
User location
Obligation class
Data subject rights, Disclosure
Audit expectation
none

What it requires

  • Part III's and Part IV's access and correction rights (sections 52 to 59 and 75 to 85) are enacted but have not been proclaimed; a public body or an organisation currently owes no statutory duty under this Act to answer an access or correction request.
  • Once Part III is in force, respond to an individual's access request within thirty days, either giving the personal information, or a written refusal stating the specific ground and the right of appeal to the Commissioner.NIST Privacy FrameworkCT.DM-P1
  • Once Part III is in force, on a correction request either correct the personal information or annotate it with the requested correction, and notify any other public body or third party the information was disclosed to in the year before the request.NIST Privacy FrameworkCT.DM-P3NIST Privacy FrameworkCM.AW-P5
  • Once Part IV is in force, respond to an individual's access request against your organisation the same way a public body must under Part III, and follow whatever access, correction, and complaint procedure your mandatory code of conduct states.NIST Privacy FrameworkCT.PO-P3

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
  • CT.DM-P1Data elements can be accessed for review.
  • CT.DM-P3Data elements can be accessed for alteration.
  • CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Where a public body does not make a requested correction it must annotate the information with the correction requested, and on correcting or annotating it must notify every public body or third party to whom the information was disclosed in the year before the request. The notice cannot be given without a record of whom the information went to, and the annotation is itself a kept record of the request. The Act names no log and sets no form or period for one. The duty is in Part III, which the row records as enacted and not yet proclaimed. Sections 75 to 85 for organisations under a mandatory code of conduct state no record duty. The one-year look-back is a window for notice, not a retention period. Individuals in Trinidad and Tobago are the persons given the access right, in the words of section 52(1).

Kind
Implicit
As of
Provision
Section 57(2) and (3)
Trigger
personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Part III, sections 52 to 59, would give every individual in Trinidad and Tobago a right of access to personal information about them held in a public body's personal information bank or otherwise under its custody or control, require the Head of a Public Body to respond within thirty days, and let an individual appeal a refusal to the Commissioner within six weeks.

Section 53 would let the Head of a Public Body refuse access where disclosure would invade another individual's privacy, reveal information supplied in confidence, reveal a confidential source of evaluative material, or fall within a Freedom of Information Act exemption, and section 68 would put the burden of proving an exemption applies on the public body.

Section 57 would give an individual a right to request correction of an error or omission, require the Head of a Public Body to annotate an unactioned correction request, and require notice of a correction to any other public body or third party the information was disclosed to in the year before the request.

Part IV, sections 75 to 85, would give the equivalent access right against an organisation subject to a mandatory code of conduct, with the same Commissioner review and complaint process, but no equivalent correction right of its own; an organisation covered by a mandatory code would instead comply with the code's own provisions.

None of Part III or Part IV is shown as commenced: section 1(2) brought only Part I and specified sections of Part II into force on , so an individual currently has no statutory access or correction right against either a public body or a private organisation under this Act. No proclamation appointing the day these provisions come into force has been located.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .