Cyber and Data Protection Act, 2021 Contents Part I – Preliminary ............................................................................................................................................................................................ 1 1. Short title .................................................................................................................................................................................................... 1 2. Object ........................................................................................................................................................................................................... 1 3. Interpretation ............................................................................................................................................................................................. 1 4. Application .................................................................................................................................................................................................. 3 Part II – Data Protection Authority ............................................................................................................................................................... 4 5. Designation of Postal and Telecommunications Regulatory Authority as Data Protection Authority ........................ 4 6. Functions of Data Protection Authority ........................................................................................................................................... 4 Part III – Quality of data .................................................................................................................................................................................. 5 7. Quality of data ........................................................................................................................................................................................... 5 Part IV – General rules on the processing of data ................................................................................................................................. 5 8. Generality .................................................................................................................................................................................................... 5 9. Purpose ......................................................................................................................................................................................................... 5 10. Non-sensitive data ................................................................................................................................................................................ 5 11. Sensitive information ........................................................................................................................................................................... 6 12. Genetic data, biometric sensitive data and health data ......................................................................................................... 7 Part V – Duties of data controller and data processor ......................................................................................................................... 8 13. Duties of data controller .................................................................................................................................................................... 8 14. Rights of data subject ......................................................................................................................................................................... 8 15. Disclosures when collecting data directly from data subject ............................................................................................... 8 16. Disclosures when not collecting data directly from data subject ....................................................................................... 9 17. Authority to process ........................................................................................................................................................................... 10 18. Security ................................................................................................................................................................................................... 10 19. Security breach notification ............................................................................................................................................................ 10 20. Obligation of notification to Authority ....................................................................................................................................... 10 21. Content of notification ...................................................................................................................................................................... 11 22. Authorisation ......................................................................................................................................................................................... 12 23. Openness of processing .................................................................................................................................................................... 12 24. Accountability ....................................................................................................................................................................................... 12 Part VI – Data subject ..................................................................................................................................................................................... 12 25. Decision taken on basis of Automatic Data Processing ........................................................................................................ 12 26. Representation of data subject who is child ............................................................................................................................ 12 27. Representation of physically, mentally or legally incapacitated data subjects ............................................................. 12 Part VII – Transborder flow ........................................................................................................................................................................... 13 ii