🇱🇨Data Protection Act, Cap. 8.18 (partially commenced)
Data Protection Act, Cap. 8.18
The Act contains a broad framework for a Data Protection Commissioner, controller registration, rights, transfers and enforcement. However, S.I. No. 4 of 2023 brought only specified portions into force from 31 January 2023.
Operative controller provisions
Sections 32–43 require compliance with the commenced data-protection principles; lawful and necessary collection; detailed direct and indirect collection information; consent or an exception; conditions for sensitive, health, research and offence data; accuracy; purpose limitation; appropriate security and processor terms; purpose-based retention; and destruction.
What is excluded from the current checklist
Parts establishing the Commissioner, registration, access and rectification procedures, direct-marketing rights, transfers, appeals and most enforcement provisions were not commenced by S.I. No. 4 of 2023. They are not presented here as current duties without a later official commencement instrument.
Official materials
Open the official-source snapshot of commenced sections 32–43.
Open the official Gazette containing the 2015 amendment notice and material.