Kiribati

Section 19(1) requires a person processing personal data on another person's behalf to inform that other person as soon as practicable after becoming aware of any personal data breach, whether or not it meets the harm threshold in section 20, and section 19(3) requires every person to keep a record of any personal data breach, including its facts, effects and remedial action, whether or not that threshold is met.

Section 19(4) requires a controller to determine whether a breach meets the section 20(1) threshold, keep a written record of that analysis, and make it available to the Office on request.

Section 20 applies to a personal data breach that has resulted in, or is likely to result in, significant harm to affected data subjects, assessed against factors including encryption or other security measures, the nature of the likely harm, mitigating action taken, and whether lost or altered data has been recovered.

When a harmful personal data breach has occurred, section 20(2) requires the relevant controller, as soon as practicable after becoming aware of the breach, to notify the Office and each affected data subject, or to notify data subjects by public notification through widely used media where direct notification would involve disproportionate effort or expense or is otherwise not feasible.

Section 20(5) requires the notification to set out the nature of the breach including, where possible, the categories and approximate numbers of data subjects and records concerned, a point of contact, the likely consequences, and the measures taken or expected to address the breach, supplying the information in phases without undue further delay where it cannot all be given at once.

Section 5 applies the Act to processing personal data within Kiribati and, outside Kiribati, to processing that offers goods or services to, or monitors the behaviour of, data subjects in Kiribati. Section 5(3) states that the Act binds the Republic.

Section 6 exempts personal, household or recreational processing and excludes processing by legally authorised authorities for criminal law enforcement, public health emergencies or national security, processing necessary to a legal claim, and processing for journalistic, educational, artistic or literary expression. Section 6(2) defers the Act for two years after commencement for a person who is not a controller of major importance.

Section 10 requires a controller to process personal data only for an explicit purpose compatible with the purpose of collection, to limit processing to what that purpose requires, to keep the data accurate and current, and not to retain it longer than necessary unless retention is authorised by law, needed for a legitimate business purpose, or consented to.

Section 11 lists twelve lawful bases for processing, including consent, voluntary provision, contractual necessity, a legal obligation, a public authority's lawful function, a medical or public health emergency, legitimate interests that do not override the data subject's fundamental rights, archiving or research, and data the data subject has intentionally made public.

Section 14 requires a controller to take reasonable measures, including a written agreement, to bind any person processing personal data on its behalf to the Act, and to pass the same written-agreement duty down to further processors. Section 18 requires appropriate technical and organisational security measures against accidental or unlawful destruction, loss, misuse, alteration, or unauthorised disclosure or access.

Section 21 requires a controller of major importance to carry out a data protection impact assessment and submit it to the Digital Transformation Office before processing likely to expose 10,000 or more data subjects to a high risk of significant harm, a duty that does not apply until the second anniversary of commencement. Sections 32 and 33 give the Minister power to make regulations and state that the Act does not limit any other obligation or right under Kiribati law.

Section 2 leaves commencement to a notice the Minister may appoint, and none was located, so nothing in this Act binds anyone yet.

Section 23(1) requires a person that processes personal data outside Kiribati or transfers it to a person outside Kiribati to take reasonable steps to verify or ensure that there is adequate protection with respect to the personal data.

Section 23(2) defines adequate protection as restrictions and obligations substantially similar to Parts III and V, rights substantially similar to Part IV, and enforceability of those restrictions, obligations and rights, and section 23(3) lets that protection rest on the destination jurisdiction's laws, on binding corporate rules, contractual clauses, a code of conduct or a certification mechanism, or on an international organisation's own policies and measures.

Section 23(4) lets the Office issue guidelines on assessing adequate protection and designate a jurisdiction, organisation, law, or measure as affording or not affording it, and section 23(6) lets the Office prohibit a transfer to a specified jurisdiction, organisation or under specified measures for want of adequate protection or for reasons of national security.

Section 24 lets a person process or transfer personal data outside Kiribati without adequate protection where the data subject has given informed consent to the transfer, the transfer is necessary to a contract with the data subject or to a medical emergency, the transfer is for the data subject's benefit and consent is impracticable but would likely be given, or the transfer follows a court or administrative order under an international agreement such as a mutual legal assistance treaty.

Section 25 requires a person processing or transferring personal data outside Kiribati to keep a written record of the reasonable steps taken under section 23(1) or the basis relied on under section 24, and to make that record available to the Office on request.

Section 13 requires a controller to tell a data subject, before collecting personal data from them, the controller's identity and contact details, the purpose of the processing, how to exercise the Part IV rights, and how to lodge a complaint with the Office under section 26, and to give that information as soon as possible afterward if it could not be given at collection.

Section 15 gives a data subject the right to obtain from a controller, at no expense and without unreasonable delay, confirmation of whether the controller is processing their personal data, a copy of it in a commonly used electronic format, correction of data that is inaccurate, out of date, incomplete or misleading, and deletion of data the controller is not entitled to retain.

Section 15(2) lets a controller charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, particularly because of its repetitive character, and section 15(4) lets a controller charge a fee for a copy of personal data only to the extent another applicable law otherwise permits.

Section 16 gives a data subject the right to withdraw consent previously given, or to object where no lawful basis applies, requires a controller to make exercising that right as easy as giving consent, and requires the controller to promptly stop processing that relies solely on the withdrawn consent.

Section 17 gives a data subject the right not to be subject to a decision based solely on automated processing of personal data that produces a legal or similarly significant effect on them, except where the decision is necessary to a contract with the data subject, authorised by a law with suitable safeguards, or authorised by the data subject's consent.

Section 26 lets a data subject aggrieved by a violation of the Act lodge a complaint with the Office, which the Office admits where the complainant has an interest in the matter and the complaint is not frivolous or vexatious.

Section 27 lets the Office investigate on the basis of an admitted complaint or of its own accord where it has reason to believe a person has violated or is likely to violate the Act, with power to require attendance, documents, or a sworn statement, and, on a warrant from the appropriate court, to search premises or computer systems and seize items related to a suspected violation.

Section 28 lets the Office, after completing an investigation, issue a notice requiring a person within a specified period to stop or refrain from the violating act, compel a downstream processor to do the same, remedy the violation including compensating an affected data subject, or pay an administrative penalty not exceeding $100,000, proportionate to the violation's gravity and repetitive nature, the person's efforts to comply, any profits made, and the harm caused.

Section 29(1) makes it an offence, punishable by a fine not exceeding $100,000 and imprisonment not exceeding ten years or both, to fail to comply with a notice issued under section 27 or 28 that is not the subject of a duly made and ongoing appeal.

Section 30 lets an affected data subject, the subject of a section 28 notice, or another interested person apply to the appropriate court for judicial review of the notice within thirty days, and section 31 lets a data subject or a consumer organisation acting on their behalf recover damages in civil proceedings for injury, loss or harm caused by a violation, without duplicating compensation already ordered under a section 28 notice.

Section 12(1) requires that wherever the Act would otherwise rely on a data subject's consent, including the retention consent under section 10(e)(iii), the automated-decision consent under section 17(c), the lawful-basis consent under section 11(2)(a), or the cross-border-transfer consent under section 24(a), that consent be obtained instead from a parent, legal guardian, or other appropriate legal representative where the data subject is under eighteen or otherwise lacks legal capacity.

Section 12(1)(b) applies the same substitution to the voluntary provision of personal data that section 11(2)(b) or section 24(b) treats as a lawful basis. Section 12(1)(c) requires a parent, guardian, or other appropriate legal representative to exercise a data subject's Part IV rights or lodge a complaint under section 26 on that data subject's behalf.

Section 12(2) disapplies the parental consent requirement for processing carried out for education, medical, or social care by a professional owing a duty of confidentiality, or necessary for court proceedings concerning the individual. Section 12(2)(c) also disapplies it where the processing concerns a child of thirteen years or older requesting information or a service by electronic means at the child's own specific request.

The Act defines no separate category of sensitive personal data, so section 12's heightened consent rule for children and individuals lacking capacity is the only special-category protection this Act states.

Section 7 makes access of any kind to a computer program or computer data held in a computer system illegal or unauthorised if the accessing person is not entitled to control access of that kind and does not have the consent of a person who is so entitled. A person who knowingly, or recklessly and without authority, causes a computer system to perform a function to secure such access is liable on conviction to a fine not exceeding $10,000 or imprisonment not exceeding 7 years, or both.

The Act applies to an act or omission in Kiribati's territory, on a Kiribati-registered ship or aircraft, or to a Kiribati national's conduct outside Kiribati where that conduct would also be an offence where it occurred. A Cybercrime Unit within the Kiribati Police Service administers the Act. The Act was assented to by the Beretitenti and states that it commences on a date the Minister appoints by notice; no commencement notice has been located.

Sections 12 to 15 of the Cybersecurity Act 2026 let the Minister, acting on the advice of the Director of the Digital Transformation Office (DTO), designate a physical, electronic or virtual infrastructure asset, network or information system as critical infrastructure where it is essential for national security or for the economic and social well-being of the population, on grounds naming electronic communications, banking and other financial services, electric power, water and wastewater, healthcare and public health, agriculture and food distribution, emergency services, fisheries, tourism and public transportation.

A designated operator, defined to include an individual, a private entity, a public body, a state-owned enterprise, or any other body that owns, operates, manages or controls the infrastructure or the information systems supporting it, must register with the DTO and notify it of any change of ownership or of the operating person or entity within 30 days.

The DTO may by written notice require the operator to furnish information it needs to assess the infrastructure's security and cybersecurity measures, and the operator must report a material change to the infrastructure's design, configuration, security or operation within 30 days of implementing it.

The DTO may issue cybersecurity standards for critical infrastructure and conduct or require periodic or ad hoc audits, inspections and penetration testing of it, and the operator must conduct and submit periodic cybersecurity assessments of the infrastructure's risk, vulnerability and preparedness to the DTO.

The operator must appoint a member of senior management as Chief Information Security Officer responsible for the operator's cybersecurity preparedness, monitoring, reporting and coordination with the DTO, and must develop, implement, communicate to staff and document technical and organisational policies, practices and processes to manage risk to its network and information infrastructure and to prevent, mitigate and remedy a cybersecurity incident.

The operator must also establish, implement and maintain a cybersecurity risk-management framework and take reasonable contractual, technical and organisational measures to manage cybersecurity risk arising from its third-party suppliers, service providers and contractors.

The operator must comply with an order the DTO, a Sectoral CERT, the Minister or a sector's regulatory authority makes to take preventative, mitigating or remedial action, and must tell the DTO where it cannot meet an obligation under this framework for financial, legal or technical reasons, which lets the Director grant an exception or modify a prescribed standard.

A failure to carry out an obligation under Parts IV or V, absent a granted exemption, is an offence under section 25, punishable on summary conviction by a fine of up to $100,000 for a first offence, up to $200,000 for a subsequent offence, and up to $200 for each day a continuing offence persists.

The Act's own Explanatory Memorandum states a materially lower set of figures for the identical offence, a fine of up to $10,000 for a first offence, up to $20,000 for a subsequent offence, and up to $100 for each day continuing, a discrepancy between the operative text and its own memorandum that is not resolved here.

Section 21 requires an operator of critical infrastructure that is the subject of a cybersecurity incident or threat of one to gather information about it, including its nature and impact, and to assess the risk it poses to the critical infrastructure, customers, suppliers and other stakeholders.

The operator must take appropriate preventative, mitigating and remedial measures to limit that risk, and must report all material information about a significant cybersecurity incident to the National CERT and any relevant Sectoral CERT within 24 hours after the incident is detected, in a form or manner the CERT may prescribe.

The operator must provide any further information the National CERT or a Sectoral CERT requests about the incident, and must allow either CERT to access its network and information infrastructure to analyse the incident, detect other potential threats, identify vulnerabilities, and advise on preventative, mitigating or remedial measures.

A failure to report is enforced through the same section 25 offence as this jurisdiction's companion critical-infrastructure operator-obligations row, punishable on summary conviction by a fine of up to $100,000 for a first offence, up to $200,000 for a subsequent offence, and up to $200 for each day a continuing offence persists, though the Act's own Explanatory Memorandum states a materially lower set of figures for the identical offence.

The Copyright Act 2018 (Act No. 8 of 2018) is Kiribati's general copyright statute, assented to by the Beretitenti on 6 November 2018 and administered by the Minister for Commerce, Industry and Co-operatives. It repeals the earlier Copyright Ordinance (Chapter 16).

Its own arrangement of sections includes one titled 'Act binds the Republic', immediately before the section on the Act's application, and lists 'Quoting from work' as a named exception to copyright infringement, at section 16, alongside other named exceptions for research or private study, temporary copying, educational use, translation, legal purposes, copying by a cultural institution, and copying to report current events to the public, running from sections 14 to 21, but the operative text setting out each exception's conditions is not reproduced in the available copies of the Act.

An intentional infringement of a protected right for a profit-making purpose carries, on conviction, a maximum fine of $50,000 or imprisonment of 7 years, or both, for an individual, and a maximum fine of $100,000 for any other person, under section 44. The Act's own text states that it commences on a date appointed by the Minister by notice; no commencement notice has been located.