Trinidad and TobagoData Protection Act, 2011
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Retention, Governance
- Audit expectation
- none
What it requires
- Part I of the Act, including the General Privacy Principles in section 6, and sections 7 to 18, 22, 23, 25(1), 26 and 28 of Part II, are in force; Part III (public-body duties), Part IV (private-sector duties) and Part V (offences and penalties) are enacted but have not been proclaimed.
- Whether or not Part III or Part IV binds you yet, be responsible for the personal information under your control, identify the purpose of collection before or at the time of collection, and get the individual's knowledge and consent for its collection, use or disclosure.NIST Privacy FrameworkCT.PO-P1
- Limit collection of personal information to what is legally undertaken and necessary for the identified purpose, retain it only as long as necessary for that purpose, and do not disclose it for another purpose without the individual's prior consent.NIST Privacy FrameworkGV.PO-P1
- Keep personal information accurate, complete and up to date as necessary for the purpose of collection, and protect it with safeguards appropriate to its sensitivity.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkPR.DS-P5
- Make available to individuals your policies and practices for managing personal information, and give an individual the ability to challenge your compliance with these Principles and a timely, appropriate response.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkGV.MT-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Data subject
Logging duty
General Privacy Principle (j) has an organisation disclose to the individual, on request, all documents about the existence, use and disclosure of the individual's personal information, which cannot be done without records of that use and disclosure. The Principles name no log and set no form or period for one. The Commissioner's audit and production powers sit in sections 9, 19 and 20, which this row does not cite, and are coded on the Commissioner row. Section 6(e), personal information kept only as long as necessary, limits the data and is not a retention period for a record. Paragraphs (h) and (l) of section 6 are coded on their own rows.
- Kind
- Implicit
- As of
- Provision
- Section 6(j)
- Trigger
- personal_data_processing
What this law does
Section 1(2) brought Part I into force on , together with sections 7 to 18, 22, 23, 25(1), 26 and 28 of Part II, while Part III, Part IV and Part V remain enacted but not proclaimed. Section 3 binds the State, and section 4 states the Act's object as protecting an individual's right to privacy and the right to keep sensitive personal information private and personal.
Section 5 keeps the Act from limiting information a party may obtain by law in a proceeding, a Court's power to compel testimony or production, or a judicial officer's own working notes. Section 6 states the General Privacy Principles, applicable to all persons who handle, store or process personal information belonging to another person, independent of whether Part III or Part IV has been brought into force for the body or organisation concerned.
Those Principles make an organisation responsible for the personal information under its control, require it to identify the collection purpose before or at collection, require the individual's knowledge and consent for collection, use or disclosure, limit collection to what is legally undertaken and necessary, limit retention and further disclosure to the purpose of collection, require the information to be accurate, complete and up to date, require appropriate safeguards, require organisations to make their information-handling policies available to individuals, and give the individual a right to challenge an organisation's compliance and receive a timely response.
Two further Principles are researched separately as their own families: paragraph (h) restricts processing sensitive personal information and paragraph (l) restricts disclosing personal information outside Trinidad and Tobago.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .