SamoaNational Digital Identification Act 2024, personal data breach notification
In force since .
A breach notification rule binding public and private bodies.
- Enforcement body
- Registrar General
- Obligation class
- Breach notice, Security, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- As a relying party or data processor in the National Digital Identification System, notify the Registrar General (a data processor may notify the relying party instead) of a personal data breach within 72 hours of becoming aware of it, describing the categories and approximate number of registered persons and records concerned; the 72 hours may be extended for the needs of law enforcement or as reasonably necessary to determine the scope of the breach.
- As the Registrar General, where a personal data breach has occurred in the National Digital Identification System or you are informed of one by a data processor or relying party, and it is likely to result in a high risk to a registered person's rights, communicate the breach to that person without undue delay, in plain and clear language, with advice on measures to mitigate its adverse effects.
- Keep a record of every personal data breach, its effects, and the remedial action taken, sufficient to demonstrate compliance with the Act's breach notification duties.NIST Privacy FrameworkPR.PO-P7
- Do not disclose, transmit, copy, or otherwise disseminate personal data collected or processed under the Act to a person not authorised under the Act or its regulations.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- RS.AN-06Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
2 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 56(1) makes unauthorised disclosure of data collected or processed under the Act an offence punishable on conviction by a fine not exceeding 50 penalty units (WST $5,000) or imprisonment not exceeding 5 years. Section 57, unauthorised access, tampering, and damage to the Identity Database, Biometric Database, passport database, or Register of Births, Deaths and Marriages, is punishable by a fine not exceeding 125 penalty units (WST $12,500) or imprisonment not exceeding 10 years for the more serious tampering and damage offences.
Penalty structure
Section 58(1)(a) caps the fine for a section 55 or 56 unauthorised-disclosure-type offence at 50 penalty units (WST $5,000), or imprisonment not exceeding 5 years. Section 58(1)(b) raises the cap to 125 penalty units (WST $12,500), or imprisonment not exceeding 10 years, for the more serious offences under sections 55(2)-(4) (tampering, damage, and related conduct). Samoa fixes the penalty unit at WST $100 under section 4 of the Fines (Review and Amendment) Act 1998.
- Rule
- Fixed only
- As of
- Currency
- WST
- Fixed cap
- 12,500
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 50(4) requires the Registrar General, relying parties and data processors to keep a record of all personal data breaches, whether or not notified, covering the facts, the effects and the remedial action, in a way that lets them demonstrate compliance. The section names no field from the log-contents list and no retention period. Sections 47 and 48 oblige a data processor or relying party to answer the Registrar General's information requests without undue delay, which is how the record can be called for; section 54(2), outside this row, is the Registrar General's general power to require information from relying parties and data processors.
- Kind
- Explicit
- As of
- Provision
- Section 50(4)
- Trigger
- security_incident
What this law does
Section 48 requires a relying party to notify the Registrar General of a personal data breach within 72 hours of becoming aware of it, describing the categories and approximate number of registered persons and personal data records concerned, and to respond without undue delay to the Registrar General's information requests.
Section 49 requires the Registrar General, on learning of a breach likely to result in a high risk to a registered person's rights, to communicate the breach to that person without undue delay in plain language, including advice on mitigating measures, or, where direct communication is not feasible, through public media.
Section 50 requires every such notification to name the notifying entity's contact details, describe the breach's likely consequences and the measures taken or proposed to address it, and requires the Registrar General, relying parties, and data processors to keep a record of all personal data breaches sufficient to demonstrate compliance.
Section 56 separately makes it an offence for a person engaged for the purposes of the Act, a relying party, a data processor, or any other person to disclose, transmit, copy, or otherwise disseminate personal data collected or processed under the Act to an unauthorised person without lawful excuse.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .