Bill submitted to Parliament on personal data protection

A government-backed “Personal Data Protection Bill” was submitted to the Parliament on Monday, aiming to establish a comprehensive legal framework governing the collection, processing, and use of personal data in the Maldives.

The government-backed bill is sponsored by West Henveiru MP Ali Ibrahim.

Its primary objective is to protect the rights of individuals whose data is being collected, while clearly defining the responsibilities of data processors. It also seeks to establish a regulatory framework governing data processing, handling sensitive information, and transfer of data to foreign entities. Additionally, the bill outlines the rights of data subjects, or the owner of the data, and introduces procedures for responding to data breaches or leaks.

To ensure effective implementation, the bill proposes the creation of a Privacy Commissioner, vested with authority to receive complaints, conduct investigations, and take enforcement action where necessary.

“The fundamental purpose of this bill is to protect the rights of individuals to whom the data belongs and to regulate the parties using such data by defining their obligations. It also encompasses general standards for data processing, the rights afforded to data subjects, or the owner of data, and the protocols for responding to data breaches,” the bill’s objectives state.

MP Ali Ibrahim noted that, once enacted, the legislation would provide detailed compliance requirements for data controllers and processors, including obligations related to record-keeping and operational standards. In certain cases, organizations would also be required to appoint a dedicated Data Protection Officer.

The bill further proposes that the functions of the Privacy Commissioner be carried out by the Information Commissioner appointed under the Right to Information Act, with the office granted the necessary legal authority to enforce the legislation.

Aligned with international data protection standards, the proposed law also introduces strict conditions for the transfer of personal data to foreign countries and international organizations. The government describes the bill as a key step toward strengthening the Maldives’ digital economy while enhancing the protection of citizens’ personal privacy.