Maldives

Section 34(a) would require the Controller to notify both the Data Protection Authority and the affected data subjects within seventy-two hours upon knowledge of, or a reasonable belief in, a personal data breach, where the breach involves special categories of personal data or any personal data that could be used to enable identity theft or fraud and the further elements the section lists are present.

The same subsection restates the duty to the Authority alone in the same terms and on the same seventy-two-hour period, counted from the receipt of knowledge of or a reasonable belief that a breach has occurred. The Bill's own text carries no Act number and no record of ratification or gazette publication, and it was still at the submission stage in the most recent reporting located, so nothing in this row binds anyone today.

Section 3 would apply the Bill to the processing of all types of personal data by a Controller or Processor in both the public and private sectors within the Maldives, including processing equipment located there and anyone maintaining an Authority, branch or agency there, and to the processing of the personal data of data subjects located in the Maldives.

Chapter 2 would establish a Data Protection Authority, whose functions the Bill proposes be carried out by the existing Information Commissioner.

Section 14 would set the principles: collection for specific, explicit and legitimate purposes declared before collection and no further processing incompatible with them, lawful, impartial and transparent processing, data adequate, relevant and necessary to those purposes, data accurate and kept up to date with inaccurate or outdated data erased or rectified without delay, retention in identifiable form no longer than the purpose needs, and processing that ensures appropriate security against unauthorized or unlawful processing and against accidental loss, destruction or damage using appropriate technical, physical or organizational measures.

Chapter 5 would carry the security duties and chapter 10 the miscellaneous provisions, including technological neutrality and the definitions the rest of the Bill turns on. The Bill's own text carries no Act number and no record of ratification or gazette publication, and it was still at the submission stage in the most recent reporting located, so nothing in this row binds anyone today.

Section 43 would require a cross-border data transfer by a Controller to be carried out on the conditions the Act specifies.

Section 44 would let a Controller or Processor transfer personal data to a jurisdiction outside the Maldives only where it has provided appropriate safeguards, and only on condition that enforceable data subject rights and effective legal remedies are available there; the safeguards would be the corporate process the Bill describes and an agreement with the receiving entity carrying a data protection process the Data Protection Authority endorses, with the Authority formulating the process by regulation.

Section 45 would let the Authority approve binding corporate rules and fixes what they must specify, including the structure and contact details of the group, the transfers and categories of data concerned, and their legally binding nature. The Bill's own text carries no Act number and no record of ratification or gazette publication, and it was still at the submission stage in the most recent reporting located, so nothing in this row binds anyone today.

Chapter 4 would carry the rights of data subjects, opening on the general provisions that govern how they are exercised and running through the right to be informed about the processing, to obtain access to the personal data held, to have it corrected where it is inaccurate or incomplete, to have it erased, to restrict its processing, to receive it in a portable form, and to object to processing including profiling.

Section 55 would give every person a right to compensation for damage caused by a breach of the Act, which the enforcement row carries. The Bill's own text carries no Act number and no record of ratification or gazette publication, and it was still at the submission stage in the most recent reporting located, so nothing in this row binds anyone today.

Section 46 would give any person the right to lodge a complaint with the Data Protection Authority about an alleged infringement of their rights, and section 47 would give the Authority the right to investigate, including to enter premises, search and copy documents and interview people, while letting it halt, suspend or decline an investigation in the cases it lists and requiring investigation records to be kept for at least five years.

Section 52 would let the Authority order processing to stop temporarily or permanently where it determines that sharing personal data across borders threatens national security or the stability of society, and section 53 would let it exempt a person or category from part of the Act.

Section 54 would require the Authority to impose administrative penalties including fines, on top of any other sanction, weighing the nature, scope and duration of the conduct and the harm caused, whether it was intentional or negligent, the steps taken to mitigate it, the responsibility assumed, any prior breaches, the degree of cooperation, the categories of data and groups affected, the timeliness and completeness of the notifications made, any previous enforcement, and the financial impact.

Section 55 would give every person a right to compensation for damage caused by a breach of the Act. The Bill's own text carries no Act number and no record of ratification or gazette publication, and it was still at the submission stage in the most recent reporting located, so nothing in this row binds anyone today.

Section 17 would prohibit the processing of special categories of personal data except in the instances it lists, beginning with the data subject's explicit consent to one or more specified purposes.

The Bill's definition of Special Categories of Personal Data would take in personal data revealing racial or ethnic origin, political opinions or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person's sex life or sexual orientation.

Section 16 would treat a child's position as a reason the interests and fundamental rights of the data subject override a legitimate interest relied on for processing. The Bill's own text carries no Act number and no record of ratification or gazette publication, and it was still at the submission stage in the most recent reporting located, so nothing in this row binds anyone today.