Data Protection Act 2025
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
Commencement not set.
A comprehensive regime rule binding public and private bodies.
As of 13 September 2026.
What it requires
- This Act is enacted but not in force: section 2 leaves commencement to a ministerial notice, and none was located as of this review, so nothing that follows binds anyone yet.
- On commencement, process personal data of a person in or connected to Kiribati only on one of the Act's lawful bases, and only for the purpose disclosed.
- On commencement, obtain the consent of a parent, guardian, or other legal representative before processing the personal data of a person under eighteen.
- On commencement, do not make a decision based solely on automated processing of personal data that produces a legal or similarly significant effect on a person, unless a listed exception applies.
- On commencement, notify the Digital Transformation Office and each affected person as soon as practicable after a personal data breach likely to result in significant harm.
- On commencement, take reasonable steps to verify adequate protection before processing personal data outside Kiribati or transferring it there.
- A person who is not a controller of major importance has a further two years from commencement before the Act applies to them (s. 6(2)).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Failing to comply with a notice issued under sections 27 or 28 is an offence carrying a fine not exceeding $100,000 and a term of imprisonment not exceeding 10 years, or both (s. 29(1)). The bill print read $20,000; the Act print reads $100,000. No offence can be committed before commencement.
Penalty structure
Enacted and not yet in force. The Digital Transformation Office may order an administrative penalty of up to $100,000 for a violation (s. 28(1)(d)); failing to comply with an Office notice is itself an offence carrying a fine of up to $100,000 and imprisonment of up to 10 years, or both (s. 29(1)). Both figures read $20,000 in the bill print this note was first researched from. Kiribati has no currency of its own; the Australian dollar is the currency it uses.
- Rule
- Fixed only
- As of
- 13 September 2026
- Currency
- AUD
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Digital Transformation Office
What it reaches
Obligation class
Consent, Data subject rights, Breach notice, Transfer, Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Act requires a controller to process personal data only on one of twelve specified lawful bases, including consent, contract necessity, legal obligation, and legitimate interests, and only for a purpose that is explicit and compatible with the purpose for which the data was collected.
It grants a data subject the right to confirm, access, correct, and delete their personal data, to withdraw consent, and not to be subject to a decision based solely on automated processing that produces a legal or similarly significant effect, subject to listed exceptions.
It requires a controller to notify the Digital Transformation Office and each affected data subject of a personal data breach likely to result in significant harm, and to take reasonable steps to verify adequate protection before processing or transferring personal data outside Kiribati. Processing the personal data of a person under eighteen requires the consent of a parent, guardian, or other legal representative, subject to listed exceptions.
Section 5(3) states that the Act binds the Republic. The Bill passed its first reading unanimously in the Maneaba ni Maungatabu on 1 April 2025. The Act print the Ministry now publishes reads “An Act entitled” and “MADE by the Maneaba ni Maungatabu and assented to by the Beretitenti”, with the assent date and act number left blank on the print, so no assent date is recorded here.
Section 2 leaves commencement to a notice the Minister may appoint, and none was located, so nothing in the Act binds anyone yet.
When LexLint raises it
high_risk_decisionsserves_minorscrawls_webtrains_models
Read the law
Act text as published by the Ministry of Information
Communications and Transport, which carries it as “Data Protection Act 2025” beside the earlier bill print. The two prints differ: the administrative penalty under s. 28(1)(d) and the fine under s. 29(1) both read $20,000 in the bill and $100,000 in the Act.