Personal Data Protection Act 2025, government personal-data protection regime
Personal Data Protection Act 2025, 6 MIRC Ch. 4 (P.L. 2025-43)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force 11 months, effective 7 October 2025.
A comprehensive regime rule binding government bodies.
As of 7 September 2026.
What it requires
- This Chapter binds only core Government ministries and agencies, and a third party acting as their data controller or processor, not a private-sector service operating outside a government engagement.
- Process personal data lawfully, fairly, and transparently, for a specified and legitimate purpose, collecting and retaining only what that purpose requires and keeping it accurate.
- Store or process personal data with technical and organizational security measures that protect against unauthorized or unlawful processing and limit access to staff who need it for their duties.
- Be able to demonstrate compliance with these principles on request of the competent authority, the Economic Policy, Planning and Statistics Office.
- A natural person residing in the Republic who is injured by improper administration of this Chapter may sue for an injunction, mandamus, or a corrective order, though not for compensatory damages against the ministry or agency itself.
If you get it wrong
Private right of actionYes
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Retention, Security, Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Act applies to core Government ministries and agencies of the Republic that collect, use, store, process, disclose, or transfer personal data of natural persons, and its definitions of data controller and data processor extend to a third party acting on behalf of such a ministry or agency, but it excludes processing for law enforcement or national intelligence and national security purposes, non-personal data, and publicly available information lawfully obtained from government records, voluntarily made available by the data subject without audience restriction, or otherwise lawfully obtained, truthful, and a matter of public concern.
It sets six personal data protection principles binding core Government ministries and agencies: a legitimate-purpose principle requiring lawful, fair, transparent processing for specified purposes; a data-minimization principle; an accuracy principle; a retention principle limiting storage to what the purpose requires; an integrity and security principle requiring appropriate technical and organizational protection and access limitation; and an accountability principle making the data controller responsible for demonstrating compliance.
The Economic Policy, Planning and Statistics Office is designated the competent authority, empowered to issue guidance, coordinate data sharing among ministries, and make implementing rules.
A natural person residing in the Republic who suffers an injury from a core Government ministry's or agency's alleged improper administration of the Act may bring suit for an injunction, mandamus, a corrective order, or a public statement of remedy, but a court may not award compensatory damages against the ministry or agency itself, though a person may separately sue an employee personally for wilful or grossly negligent conduct.
The Act states no penalty or offence provision, and section 417 lets the competent authority make further regulations, with Cabinet approval, for the Chapter's effective performance.
When LexLint raises it
automated_outreach