Law / East Timor

East Timor

privacy

Timor-Leste has no personal-data-protection statute; its only rule is Section 38 of the 2002 Constitution, a directly enforceable but undefined right.

Section 38(1) grants every citizen access to personal data held about them and the right to demand its purpose, and section 38(3) prohibits processing sensitive-category data, private life, political or philosophical convictions, religious faith, party or trade union membership, and ethnical origin, without consent, but section 38(2) itself defers the concept of personal data and its processing conditions to a statute that has never been enacted.

Current reporting confirms no comprehensive personal-data law has advanced since a 2021 government announcement that was never published or enacted, though a pending cybersecurity legislative package, submitted for parliamentary authorisation 31 July 2026, is described as including a personal-data-and-privacy component whose text was not located this pass.

Decree-Law No. 12/2024 (electronic commerce) was checked only through a secondary description page with no hits for "personal data," which establishes nothing about its actual content, so neither it nor the cybersecurity package's provisions are authored as instruments here.

7 instruments named 1 researched in detail As of 2026-08-29

Instruments

Each one links to its LexLint note, which carries what it requires and what it flags on.

Comprehensive regime

Constitution of the Democratic Republic of Timor-Leste, Section 38 (Protection of personal data)

cite Constitution of the Democratic Republic of Timor-Leste (2002), Section 38 stage IN FORCE in force since 2002-05-20 binds public and private bodies source Constitution of the Democratic Republic of Timor-Leste, official government text (timor-leste.gov.tl)

What it requires →

Section 38 of Timor-Leste's Constitution, read verbatim in full, grants every citizen a right to access personal data about them held in a computer system or manual records and to demand the purpose of that data (38(1)), and prohibits processing data on private life, political or philosophical convictions, religious faith, party or trade union membership, and ethnical origin without the individual's consent (38(3)).

Section 38(2) itself defers the concept of personal data, and the conditions applicable to processing it generally, to a law that Timor-Leste has never enacted, so there is no defined scope, no supervisory authority, and no procedural mechanism behind either right.

No biometric-specific provision exists anywhere in the Constitution, and section 38(3)'s named sensitive categories do not include biometric data, so a voiceprint or faceprint falls only under the undefined general access right, with the sensitive-category consent requirement's reach to it uncertain. Adjacent Section 36 (honour and privacy) and Section 37 (inviolability of home and correspondence) protect related interests but create no personal-data-specific duty.

This summary covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted above and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.