Personal Data Protection Act, 2022, sensitive personal data
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 May 2023.
A sensitive categories rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Obtain the data subject's prior written consent before processing genetic, biometric or other sensitive personal data, including data related to a child, and where the data subject is a minor or otherwise unable to consent, seek that consent from a parent, guardian or other legal representative.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Sensitive personal data, defined to include genetic data, data related to children, data related to offences, financial transactions, security measures and biometric data, may not be processed without the data subject's prior written consent, which may be withdrawn at any time without explanation or charge.
The Minister may by regulation determine circumstances in which the prohibition cannot be removed even with the data subject's consent, and where the data subject is a minor, a person of unsound mind, or another person unable to consent, consent must instead be sought from a parent, guardian or other legal representative.
When LexLint raises it
processes_biometricsprocesses_voiceserves_minors