Data Protection & Cyber Security: Question Index

Data Protection & Cyber Security

Do the laws in your jurisdiction require appointment of a data protection officer, or other person to be in charge of privacy or data protection at the organization? What are the data protection officer’s legal responsibilities?

Jurisdiction Answers:

Data Protection & Cyber Security

Do the laws in your jurisdiction require providing notice to individuals of the business’ processing activities? If so, please describe these notice requirements (e.g. posting an online privacy notice).

Jurisdiction Answers:

Data Protection & Cyber Security

Do the laws in your jurisdiction apply directly to service providers that process PII, or do they typically only apply through flow-down contractual requirements from the owners?

Jurisdiction Answers:

Data Protection & Cyber Security

Do the laws in your jurisdiction require minimum contract terms with service providers or are there any other restrictions relating to the appointment of service providers (e.g. due diligence or privacy and security assessments)?

Jurisdiction Answers:

Data Protection & Cyber Security

Is the transfer of PII outside the jurisdiction restricted? If so, please describe these restrictions and how businesses typically comply with them (for example, does cross-border transfer of PII require notification to or authorization form a regulator?)

Jurisdiction Answers:

Data Protection & Cyber Security

What security obligations are imposed on PII owners and on service providers, if any, in your jurisdiction?

Jurisdiction Answers:

Data Protection & Cyber Security

Does your jurisdiction impose requirements of data protection by design or default?

Jurisdiction Answers:

Data Protection & Cyber Security

Do the laws in your jurisdiction address security breaches and, if so, how does the law define “security breach”?

Jurisdiction Answers:

Data Protection & Cyber Security

Under what circumstances must a business report security breaches to regulators, to individuals, or to other persons or entities? If breach notification is not required by law, is it recommended by the regulator and what is the typical custom or practice in your jurisdiction?

Jurisdiction Answers:

Data Protection & Cyber Security

Do the laws in your jurisdiction provide individual rights, such as the right to access and the right to deletion? If so, please provide a general description on what are the rights, how are they communicated, what exceptions exist and any other relevant details.

Jurisdiction Answers: