Law: The Data Protection Act, 2018 (the Act) 

Regulator: The Information and Data Protection Commission

Summary: On October 15, 2021, the Data Protection Act, 2018 (the Act) entered into effect more than three years after the National Assembly approved it on July 12, 2018. The Act regulates data controllers and processors and establishes consent as a central principle for data processing. The Act also provides for data subject rights and sets out restrictions on direct marketing, sensitive data, and data transfers. Further, the Act requires data breach and processing notifications in certain circumstances. In broad terms, the Act echoes the approach taken by the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR) although diverging by establishing potential prison terms ranging from three to 12 years for certain violations.

On October 29, 2024, the Data Protection Act 2024 (the Act of 2024) was published in the Official Gazette, after being assented to on October 24, 2024, repealing and re-enacting the Act with amendments. The Act 2024 will enter into force on a date appointed by the Minister in the Official Gazette.