Comprehensive regime
Data Protection Act, 2011
Act No. 13 of 2011 (Data Protection Act), Chap. 22:04Consolidated text of the Data Protection Act
Commencement not set. Binds public and private bodies.
What this law does
Section 6 states the General Privacy Principles, applicable to all persons who handle, store, or process personal information belonging to another person: an organisation is responsible for personal information under its control, must identify the collection purpose before or at collection, needs the individual's knowledge and consent for collection, use, or disclosure, must retain the information no longer than necessary, keep it accurate, and protect it with safeguards appropriate to its sensitivity, and may disclose it outside Trinidad and Tobago only where comparable safeguards exist in the receiving jurisdiction.
Section 69 (Part IV) would apply the General Privacy Principles to any person who collects, retains, manages, uses, processes, or stores personal information in Trinidad and Tobago, or who collects it from individuals there, and sections 70 to 86 would let the Commissioner require industry codes of conduct and give individuals a right to access and correct personal information held by an organisation.
Section 1(2) provides that Part I and sections 7 to 18, 22, 23, 25(1), 26, and 28 came into operation on 6 January 2012 under Legal Notice No. 2 of 2012; Part IV and Part V, which state the private-sector duties and the Act's offences and penalties, are not listed among the commenced provisions and have not been proclaimed.
What it requires