Maldives Personal Data Protection Bill, investigation, enforcement and compensation

Personal Data Protection Bill, chapter 9 and sections 52-55 (investigation, enforcement and compensation)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Proposed: draft date not recorded.

An enforcement supervision rule binding public and private bodies.

As of 19 September 2026.

What it requires

The Maldives' Personal Data Protection Bill has not been enacted and creates no binding duty as of the date shown; it was submitted to the People's Majlis on 11 May 2026 and had not passed a chamber as of the most recent reporting located.
If enacted as drafted, any person could complain to the Data Protection Authority about your processing, and the Authority could investigate, enter your premises, search and copy your documents and interview your people.
If enacted as drafted, the Authority could order your processing stopped, temporarily or permanently, where it determined that sharing personal data across borders threatened national security or the stability of society.
If enacted as drafted, the Authority would impose administrative fines on top of any other sanction, weighing among other things how complete and timely your notifications were and what you did to mitigate the harm, and every person would have a right to compensation for damage caused.

What it reaches

Obligation class

Governance, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 46 would give any person the right to lodge a complaint with the Data Protection Authority about an alleged infringement of their rights, and section 47 would give the Authority the right to investigate, including to enter premises, search and copy documents and interview people, while letting it halt, suspend or decline an investigation in the cases it lists and requiring investigation records to be kept for at least five years.

Section 52 would let the Authority order processing to stop temporarily or permanently where it determines that sharing personal data across borders threatens national security or the stability of society, and section 53 would let it exempt a person or category from part of the Act.

Section 54 would require the Authority to impose administrative penalties including fines, on top of any other sanction, weighing the nature, scope and duration of the conduct and the harm caused, whether it was intentional or negligent, the steps taken to mitigate it, the responsibility assumed, any prior breaches, the degree of cooperation, the categories of data and groups affected, the timeliness and completeness of the notifications made, any previous enforcement, and the financial impact.

Section 55 would give every person a right to compensation for damage caused by a breach of the Act. The Bill's own text carries no Act number and no record of ratification or gazette publication, and it was still at the submission stage in the most recent reporting located, so nothing in this row binds anyone today.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
high_risk_decisions

Read the law

draft bill text hosted at mifps.com.mv, not an official government publication
corroborated by a Maldivian news report on the submission event

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app