Vatican CityGeneral Regulation on the Protection of Personal Data for Vatican City State
In force since .
A comprehensive regime rule binding government bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Security
- Audit expectation
- on_request
- Who audits it
- Self, Regulator
What it requires
- This decree binds Vatican City State institutions processing personal data via the Governorate, within Vatican City State territory or the Lateran Treaty extraterritorial zones. It does not establish a general private-sector personal data regime, and no ordinary commercial or consumer-facing application's obligations under it are confirmed. Review it if your app crawls, trains on, or deploys a chatbot against data belonging to a Vatican City State institution.
- Where this Regulation binds your processing, identify the Data Controller as the Governorate, represented by the General Secretary, and put in place organizational and technical security measures suitable to protect the personal data you process. Appoint a Representative in writing where the Regulation calls for one, and record the activity in the Register of treatment activities.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What becomes of the General Regulation when the 'triennio' (three-year period) for which Article 28, paragraph 1 brings it into force 'ad experimentum' (on a trial basis) ends: does it lapse, or does it continue until another act renews, amends or replaces it?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 9 obliges the Data Controller and each person responsible for treatment to keep a Register of treatment activities, kept and periodically updated by the Referenti, naming among other things the purposes of treatment, the categories of data and recipients, the risk assessment, the security measures and a brief description of any security incidents. The Register carries no field from the log-contents list, so none is coded. The retention period for each data category is recorded in the Register by Article 23(2), the proof of consent is Article 7(1) and the 72-hour report of a breach to the person responsible and the Data Protection Officer is Article 13(2); none of those three is cited by this row. Article 12(5) lets the Data Protection Officer, who is the Regulation's own oversight officer rather than an outside authority, ask for compliance information and run verifications.
- Kind
- Explicit
- As of
- Provision
- Article 9, paragraphs 1 to 3
- Trigger
- personal_data_processing
What this law does
Article 1 of the Regulation states rules on the protection of physical persons with regard to the treatment of personal data, and rules on the free movement of such data, respecting human dignity and the rights and freedoms of the person.
Article 2, paragraph 1 applies the Regulation to treatment of personal data carried out by the Governorate, limited to the territory of Vatican City State or to activities the Governorate carries out in the zones named in Articles 15 and 16 of the Lateran Treaty.
Article 2, paragraph 2 excludes treatment a physical person carries out for exclusively personal purposes where the data are not destined for systematic communication or dissemination, data the Interested party has made manifestly public, and anonymized data. Article 11, paragraph 1 makes the Data Controller the Governorate, represented by its General Secretary.
Article 11, paragraph 2 has the Data Controller determine the purposes and methods of treatment so that those responsible for treatment can identify technical and organizational measures (Security Measures) suited to guarantee the protection of personal data. Article 12, paragraph 1 has the Data Controller choose, from the senior roles of the Bodies of the Governorate, those responsible for treatment, who implement the Regulation and appoint Referenti where the Regulation provides.
Article 13 has the Data Controller and each person responsible for treatment designate one or more Referenti, drawn from their employees, by a written act setting the duration, content, duties and responsibilities of the appointment, and makes the Referenti the persons authorized to put into effect the Security Measures identified in the Register of treatment activities.
Because the Regulation applies only to treatment carried out by the Governorate, its practical effect is government and institutional processing rather than a general private-sector regime.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or processes personal data.
Back to the example · Lint your app
Page updated .