Maldives Personal Data Protection Bill, personal data breach notification

Personal Data Protection Bill, section 34 (personal data breach notification)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Proposed: draft date not recorded.

A breach notification rule binding public and private bodies.

As of 19 September 2026.

What it requires

The Maldives' Personal Data Protection Bill has not been enacted and creates no binding duty as of the date shown; it was submitted to the People's Majlis on 11 May 2026 and had not passed a chamber as of the most recent reporting located.
If enacted as drafted, a Controller would have to notify the Data Protection Authority within 72 hours of coming to know of, or reasonably believing in, a personal data breach involving special categories of personal data or data that could enable identity theft or fraud.
If enacted as drafted, the same section would require the affected data subjects to be told, on the same seventy-two-hour period and on the same trigger.

What it reaches

Obligation class

Breach notice, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 34(a) would require the Controller to notify both the Data Protection Authority and the affected data subjects within seventy-two hours upon knowledge of, or a reasonable belief in, a personal data breach, where the breach involves special categories of personal data or any personal data that could be used to enable identity theft or fraud and the further elements the section lists are present.

The same subsection restates the duty to the Authority alone in the same terms and on the same seventy-two-hour period, counted from the receipt of knowledge of or a reasonable belief that a breach has occurred. The Bill's own text carries no Act number and no record of ratification or gazette publication, and it was still at the submission stage in the most recent reporting located, so nothing in this row binds anyone today.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics
operates_essential_service

Read the law

draft bill text hosted at mifps.com.mv, not an official government publication
corroborated by a Maldivian news report on the submission event

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app