Data Protection Act, 2018, processing of sensitive personal data

Data Protection Act, 2018, s. 20 (processing of sensitive personal data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

This law was passed and gazetted in 2018 but, on its own terms, does not take effect until a Ministerial commencement order is published in the Gazette; no such order has been located, so whether it currently binds has to be confirmed before relying on what follows.
Do not process sensitive personal data, meaning information about a data subject's physical or mental health, sexual orientation, political opinions, religious or similar beliefs, or an offence they committed or are alleged to have committed, unless a listed exception applies.
Process sensitive personal data only with the data subject's explicit consent, for an employment right or obligation, to protect vital interests where consent cannot be given or has been unreasonably withheld, for medical purposes by a healthcare professional or an equivalent confidant, for legal proceedings, advice, or the administration of justice, or where the data subject has deliberately made the information public.

What it reaches

Obligation class

Prohibition, Consent

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 2 defines sensitive personal data as information about a data subject's physical or mental health or condition, sexual orientation, political opinions, religious or similar beliefs, or the commission or alleged commission of an offence, or any other personal data the Minister determines by order published in the Gazette. Section 20(1) bars a data user from processing sensitive personal data of a data subject except in accordance with the listed conditions.

Section 20(1)(a) permits processing on the data subject's explicit consent, and section 20(1)(b) permits it where necessary for an employment right or obligation, to protect the vital interests of the data subject or another person where consent cannot be given or has been unreasonably withheld, for medical purposes undertaken by a healthcare professional or someone under an equivalent duty of confidentiality, for legal proceedings or advice, for establishing or defending legal rights, for the administration of justice, for a function conferred by law, or for any other purpose the Minister thinks fit.

Section 20(1)(c) also permits processing where the data subject has deliberately made the information public. Section 20(3) makes unlawful processing of sensitive personal data an offence carrying a fine not exceeding two hundred thousand dollars or imprisonment not exceeding two years, or both.

When LexLint raises it

crawls_web
trains_models
handles_health_records

Read the law

Data Protection Act, 2018 (No. 5 of 2018), Saint Kitts and Nevis Law Commission text, preserved on archive.org

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived July 25, 2024. Publisher's page: https://lawcommission.gov.kn/wp-content/documents/Annual-Laws/2018/ACTs/Act-5-of-2018-Data-Protection-Act-2018.pdf

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app