Bhutan

Section 424 makes it a felony of the fourth degree for a person to publish, distribute, or transmit an obscene communication or material depicting children engaged in a sexually explicit act, or to create text or digital images, collect, seek, browse, download, advertise, promote, exchange, or distribute material in any form depicting children in an obscene, indecent, or sexually explicit manner, or to record own or another's abuse of a child in a sexually explicit act.

The offence's second limb criminalises creating a digital image or text depicting a child in that manner without requiring that the depicted child be a real, identifiable person, so on the section's own text it reaches a computer-generated or AI-synthesized depiction of a child in the same terms as one derived from a real photograph.

Chapter 21 imposes a general consent-for-collection duty (s.384: express written permission of the subject, unless permitted or required by law), a non-disclosure duty absent authorization or legal requirement (s.385), and a duty to delete or destroy obsolete personal information, including sensitive personal data (s.386), on "a person" generally.

Chapter 17 imposes a fuller set of duties specifically on an ICT and Media facility or service provider and vendor: a duty to respect and protect privacy (s.336), a mandatory published privacy policy disclosing data types, sources, purposes, use, disclosure recipients, and opt-out options (ss.337-338), collection and use limited to what a reasonable person would consider appropriate (s.339), storage and use limited to the intended purpose (s.340), no disclosure to affiliates or third parties beyond the transaction absent written authorization (s.341), and continuing responsibility, with contractual binding, for personal data a provider transfers to a third party (ss.342-343).

No phased-commencement language was found for these chapters; this instrument is not recorded as currently in effect for lack of a confirmed primary commencement date, though the chapters function as operative law in practice. The Act's own Section 2 ("Commencement") sets a single, whole-Act date rather than a chapter-by-chapter schedule: "This Act comes into force on the 22nd Day of the 11th month of the Fire Female Bird Year corresponding to 8th Day of the January 2018."

Section 338(3) requires an ICT and Media facility or service provider and vendor to let users or consumers review and, when necessary, have their information amended or removed. Section 340 requires information to be removed or withdrawn upon a user's request. These rights run specifically against an ICT/Media provider under Chapter 17; no equivalent named right was found running against a general Chapter 21 data handler. No express portability right was found.

Issued by BICMA under section 58 of the ICM Act as a binding code of practice for licensed Telecom Service Providers and other ICT service providers operating critical information infrastructure, in force since 10 October 2024.

Section 8.6 requires a licensee to establish and communicate a topic-specific policy on privacy and protection of Personally Identifiable Information (PII), to implement procedures for preserving that privacy, and to put in place appropriate technical and organizational measures, expressly deferring compliance to "relevant legislation and regulations" (the ICM Act's own Chapter 21 duties).

The Code does not itself define "PII" or name biometric data, and its incident-response requirement (s.12.1) requires only that a licensee's Incident Response Plan include a reporting structure aligned with "its reporting obligations under the Act and any other laws and regulations"; it creates no independent breach-notification threshold, recipient, or timeline of its own. It is a separate, more recent, government-issued instrument, not a republication of the ICM Act.

The Bhutan InfoComm and Media Authority (BICMA), the unified telecom, broadcast, media, and ICT regulator this Act establishes, is the supervisory authority for the whole Act, including Chapters 17, 21, and 22, though its specific enforcement powers over the Chapter 21/17 civil-obligation provisions were not independently traced beyond Chapter 22's own offence sections.

Section 387 ("Failure to protect data") makes a person possessing, dealing with, or handling personal data, including sensitive personal data, who is negligent in implementing reasonable security practices and thereby causes wrongful loss or gain, liable to pay court-determined compensation to the victim, a genuine private right of action in substance.

Section 388 ("Unlawful Disclosure of data or information") separately makes it an offence to disclose another's personal data without consent or in breach of a lawful contract, intending or knowing it likely to cause wrongful loss or gain; its exact penalty tier is not confirmed due to an extraction artifact at a page break.

Definitions item (89) lists biometric information as a Sensitive Personal Data or Information category, alongside password, financial information, physical/physiological/mental health condition, sexual orientation, medical records, and a residual "other information legally deemed to be private" category.

The item's own proviso carves information that is freely available or accessible in the public domain, or available under another existing national law, out of the sensitive-personal-information classification, though this does not obviously rescue a voiceprint or faceprint derived from public material, since the derived identifier is a distinct data element from its source recording.

No standalone definition of "biometric information" exists; the term is not otherwise defined, and neither "voice" nor "voiceprint" nor "facial image" appears anywhere in the Act as its own named term. Creating and storing an identity-linked voiceprint or faceprint would be handling Sensitive Personal Data, triggering Chapter 21's consent, non-disclosure, and destruction duties, and, where done by an ICT/media provider, Chapter 17's fuller duties.

Section 415 makes it an offence, keyed to intent to cause or knowledge that it is likely to cause wrongful loss, gain, or damage, to access a computer, computer system, network, or computer, content, or traffic data and thereby cause a stoppage or denial of service, delete or alter data, diminish a system's value or utility, or introduce a computer contaminant; the section labels this "tampering with computer material", punishable under the Penal Code of Bhutan.

Section 416 separately makes unauthorized access to a computer, computer system, network, or computer, content, or traffic data an offence in its own right, without requiring the loss, gain, or damage element of section 415, graded a felony of the fourth degree with court-determined compensation to the victim.

Section 348 requires that a communication addressed to children, or likely to be of particular interest to children, be age-appropriate, and prohibits exploiting the credulity, lack of experience, or sense of loyalty of children. Section 349 requires an ICT and Media facility or service provider and vendor to take all reasonable steps to prevent offensive communications being delivered to children and to prevent children from being drawn into conducting business transactions of any kind.

Section 351 bars an advertisement, in any form, that is aimed at taking advantage of a child's vulnerabilities. A separate provision in the same chapter, section 350, additionally bars an ICT or media provider from collecting or disclosing a child's personal information without a parent's or guardian's express, verifiable consent; because that duty attaches to personal data rather than to content or advertising, it is not carried on this instrument.

Section 11 permits, without the copyright owner's authorization, the reproduction of a short part of a published work in the form of a quotation in another work, provided the reproduction is compatible with fair practice and its extent does not exceed the extent justified by the purpose. The quotation must be accompanied by an indication of its source and the author's name where that name appears on the work quoted.

Section 14(a) permits a newspaper or periodical to reproduce, or to broadcast or otherwise communicate to the public, an article published in a newspaper or periodical on a current economic, political, or religious topic, or a broadcast work of the same character, without the author's authorization, subject to the obligation to indicate the source and the author's name; this permission does not apply where the original rightsholder has expressly reserved the right to authorize such reproduction.

Section 14(b) separately permits reproducing and broadcasting short excerpts of a work seen or heard in the course of an event, for the purpose of reporting current events, to the extent justified by that purpose. Section 14(c) covers reproduction of a political speech, lecture, address, sermon, or similar public work.