Suriname

This measure is a draft bill; it binds nobody yet, and what follows describes what it would require if enacted in the form read.

Article 20(1) requires a controller to notify the Commissioner for Personal Data Protection of a breach relating to personal data without delay and, if possible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to pose a risk to individuals' rights and freedoms; where notice is not given within 72 hours, the controller must also state the reasons for the delay.

Article 20(2) requires that notice to describe, at minimum, the nature of the breach, the categories and approximate number of data subjects and records affected, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects, with article 20(3) allowing the information to be given in phases without unreasonable delay where it cannot all be given at once.

Article 16(j) requires a processor to inform the controller without unreasonable delay after becoming aware of a breach relating to personal data. Article 20(4) requires a controller to document every breach, including its facts, effects, and the corrective measures taken, in a form that lets the Commissioner verify compliance with the article.

Article 20(5) lets the Commissioner, after weighing the breach's nature, likely consequences, and mitigation measures, require the controller to notify affected individuals and specify the communications and means to use; article 20(6) has the Commissioner keep a non-public register of breach notifications it receives. The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.

This measure is a draft bill; it binds nobody yet, and what follows describes what it would require if enacted in the form read.

The bill defines privacy as the right to protection of all information about an identified or identifiable living natural person, and defines personal data the same way, an identifiable natural person being one who can be identified directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural or social identity.

Article 5 sets out the processing principles: lawfulness and fairness, openness and transparency, purpose limitation and data minimization, data quality, storage limitation, security safeguards, data-subject participation, ethical processing, and accountability.

Article 6 requires a lawful basis before processing, running from contractual necessity, a legal obligation, vital interests, a public-interest task, and official authority through to a legitimate interest that does not override the data subject's rights, or the data subject's own specific, informed consent presented separately from other matters and withdrawable at any time.

Article 12 lets specific laws narrow the rights and obligations in article 5, chapter III, and article 20(5) for purposes including national security, defence, public safety, and the prevention, investigation, detection or prosecution of criminal offences. Article 14 requires a controller and, where applicable, a processor to take appropriate technical and organizational measures able to demonstrate compliance on request, and to bind anyone with access to personal data to confidentiality.

Article 15 requires data protection by design and by default under article 17, a written processor contract, and cooperation between joint controllers. Article 18 requires a controller and processor to keep a register of processing activities and notify it to the Commissioner for Personal Data Protection, updated whenever needed and at least once a year. Article 19 requires appropriate technical and organizational security measures matched to the risk.

Article 21 requires a controller and a processor each to appoint a data protection officer to advise on this law's duties, liaise with the Commissioner, and act as the contact point for a data subject exercising their rights. The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.

This measure is a draft bill; it binds nobody yet, and what follows describes what it would require if enacted in the form read.

Article 22(1) bars a controller or processor from transferring personal data to a recipient in a third country unless the recipient is subject to a law, binding corporate rules, or a binding agreement that offers a level of protection substantially comparable to this law's own processing principles and its rules on onward transfer, or one of the article 6 lawful bases for processing applies, or the Commissioner for Personal Data Protection has authorised that specific transfer.

Article 22(2) narrows that further for special categories of personal data and criminal conviction or offence data, which may only be transferred where the recipient is bound by such an adequate protection instrument or the Commissioner has specifically authorised the transfer, not merely on an article 6 lawful basis.

Article 22(3) lets the Commissioner identify, in accordance with article 31(1)(j), which laws, binding corporate rules or binding agreements offer an adequate level of protection under article 22(1)(a). The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.

This measure is a draft bill; it binds nobody yet, and what follows describes what it would require if enacted in the form read.

Article 10 requires a controller to give a data subject the identity and contact details of the controller and any representative, the data protection officer's contact details where one exists, the purposes and legal basis of the processing, the categories of data, the recipients including any third country recipient, the storage period, the existence of the data subject's rights, and the right to complain to the Commissioner.

That information is due when the data are collected from the data subject, or, where they were not, within a reasonable time and at latest within one month.

Article 11 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects for them or otherwise significantly affects them, unless a listed exception applies, and bars such a decision from resting on special categories of personal data unless a narrow exception applies with appropriate safeguards.

It also gives a data subject the right to confirmation of processing and to the reasons underlying a decision applied to them, a right to portability of data they provided under a contract or consent and processed by automated means, a right to object at any time to processing on grounds relating to their situation, with processing for direct marketing and its related profiling stopping outright once the data subject objects, a right to rectification or erasure where processing violated this law, and a right to withdraw consent at any time as easily as it was given.

A controller must act on a rights request without undue delay and within one month of receipt, extendable by one further month for complex or numerous requests with notice of the extension within three weeks, and must tell a data subject who it declines to act for why within one month, including the possibility of a complaint to the Commissioner or a court.

Exercising these rights and receiving the article 10 information is free, except that a controller facing a manifestly unfounded or excessive request, particularly a repetitive one, may charge a reasonable administrative fee or refuse it, bearing the burden of showing the request is unfounded or excessive. The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.

This measure is a draft bill; it binds nobody yet, and what follows describes what it would require if enacted in the form read. Article 23 establishes an independent Commissioner for Personal Data Protection (Commissaris voor Persoonsgegevensbescherming), responsible for supervising and enforcing this law, accountable to De Nationale Assemblee.

Article 33 gives every data subject or their legal representative the right to lodge a complaint with the Commissioner, and articles 34 and 37 set the complaint procedure, including a decision within three months, extendable by three months for complex cases, and the factors the Commissioner weighs before imposing a fine.

Article 35 lets the Commissioner fine a controller or processor for a violation: up to SRD 5,000 or 2 percent of worldwide annual turnover, whichever is higher, for violating the chapter V obligations on controllers and processors, and up to SRD 10,000 or 4 percent of worldwide annual turnover, whichever is higher, for violating the principles, rights, or cross border transfer chapters, or for failing to comply with a Commissioner decision, order, or notice or to grant access needed for a complaint investigation.

Articles 38 and 39 give a person effective judicial remedies against the Commissioner and against a controller or processor respectively, before the kantonrechter, and article 40 gives every person who suffers material or non-material damage from a violation of this law the right to compensation from the controller or processor responsible, with joint and several liability where more than one is involved.

Article 41 bars an employer from dismissing, suspending, demoting, disciplining, fining, intimidating or otherwise disadvantaging an employee for reporting in good faith that the employer or another person has violated or will violate this law. Article 42 lets a data subject authorise a nonprofit organisation active in privacy protection to lodge a complaint or exercise their judicial and compensation rights on their behalf.

The bill contains no criminal penalty for a violation; its sanctions are the administrative fine, the compensation claim, and the Commissioner's other decisions and orders. The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.

This measure is a draft bill; it binds nobody yet, and what follows describes what it would require if enacted in the form read. Article 7 sets the age at which a child's own consent to processing is valid at sixteen; below that age, processing based on consent is lawful only where a legal representative gave it, the controller must take reasonable steps to verify that, and a child's personal data may never be processed in a way inconsistent with the child's interest.

Article 8(1) prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and prohibits processing genetic data, biometric data, health data, or data concerning a person's sexual behaviour or orientation, subject to the exceptions article 8(2) lists, such as the data subject's explicit consent or processing necessary to protect vital interests.

Article 8(3) requires particular care in processing that data so it does not cause unfair discrimination, prejudice, or other harm to the data subject. The bill defines biometric data as personal data resulting from specific technical processing of a natural person's physical, physiological or behavioural characteristics that allows or confirms that person's unique identification, expressly including facial images, blood type, fingerprints, DNA analysis, retinal scans, and voice recognition.

Article 9(1) allows processing personal data about a criminal conviction or offence only under the supervision of an official authority, or where a specific law permits it with appropriate safeguards, and reserves a comprehensive register of convictions to supervision by an official authority; article 9(2) lets a controller that is not an official authority process such data for an employment-law purpose only if it keeps an internal policy document, available to the Commissioner on request, explaining its article 5 compliance procedures and its retention and erasure policy for that data.

The bill remains under consideration before De Nationale Assemblee, with no enactment timeline.