On May 30, 2024, the Office of the Information Commissioner (OIC) noted that the six-month extension for data controllers to prepare for the Data Protection Act (the Act) ended on May 31, 2024.

The OIC stated that starting June 1, 2024, data controllers can register with the OIC for the first registration year, covering December 1, 2023, to November 30, 2024. From June 1 to August 31, 2024, the OIC noted that it will prioritize processing registrations for:

• all public authorities as defined by the Act; and
• all other data controllers processing personal data, including sensitive personal data or data related to criminal convictions, for an estimate of 10,000 or more data subjects and operating within the sectors specified below:
  • education;
  • finance;
  • health;
  • information and Communication Technologies (ICT); and
  • tourism and hospitality.

The OIC explained that:

• any data controller including sole proprietors/practitioners or operators of micro, small, and medium-sized enterprises across all sectors or industries can submit their application for registration;
• data controllers must have a validated data controller account to access the registration form on the 'My OIC Portal' of the OIC's website; and
• on June 1, 2024, data controllers with accounts will be granted access to the registration form where they can proceed to enter their registration particulars. Data controllers may save and close the registration form if they are unable to enter all particulars at one time and will have 30 days from the date of first log-in to complete and submit the application and upload any supporting documents in PDF.

Following the completion of the registration form, the OIC stated that data controllers must pay the prescribed fees which are as follows:

• for companies and public authorities: $25,000;
• for partnerships: $15,000; and
• sole traders and individuals: $7,500.

The OIC highlighted that the particulars of data controllers who have successfully registered with the OIC will be published in the online Register of Data Controllers, pursuant to section 17 of the Act, for the remainder of this current registration year.

The OIC noted that following the initial registration, all data controllers must renew their registration and pay the prescribed fees on or before December 1 of each subsequent registration year.

You can read the press release here.