Draft Data Protection Bill Overview

The purpose of this Bill is to protect a person’s right with respect to the processing of personal data. The
draft Bill has been circulated for public commentary. This Bill recognises a person’s right to privacy
universally recognised as one of the inalienable rights of humans in Article 12 of the Universal Declaration
of Human Rights, and Article 17 of the International Covenant on Civil and Political Rights.

The objectives of the Draft law are:
(a) define the general principles of data protection and the rights of data subjects;
(b) protect personal data collected, used or stored by both private and public entities; and
(c) provide for enforcement mechanisms, including penalties, for failure to process personal data
in accordance with the law.

The Parts of the Draft Bill can be summarized as follows:

• Part I states that the law shall be applicable to the processing of personal data by data controllers
  and data processors who are established in Guyana; or who, although not established in Guyana who
  use equipment located in Guyana for the processing of personal data (otherwise than for transit
  through Guyana) or process personal data of an individual in Guyana.
• Part II outlines the data protection principles, general principles governing the conditions of consent
  in relation to processing of personal data.
• Part III outlines the rights of the data subject.
• Part IV outlines the general principles governing the safeguards which must be established where
  there is a transfer of the personal data of data subjects outside of Guyana.
• Part V outlines instances in which a data controller will not be required to comply with certain
  provisions of the legislation. For example, provision is made for personal data which are processed
  only for special purposes (that is, journalism, artistic or literary purposes) are exempt from the data
  protection principles.
• Part VI outlines the obligations of the data controller, data processor and data protection officer as
  well as penalties for not registering as a data controller or processor under the new law.
• Part VII establishes the office of the Data Protection Commissioner and sets out the functions of that
  office.
• Part VIII sets out the enforcement powers of the Commissioner.
• Part IX contains the general provisions of the Bill and provisions relating to penalties.

LI&P continues to monitor legislative updates in Guyana. Please contact us for a copy of the draft Bill.