Based mainly on secondary sources. Only 2 of the sources retrieved for this jurisdiction are official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved.

MH

MH schema gdpri-v2 trajectory: not yet assessedunregulated gapoverlaps: FIM, WPM

The Marshall Islands has, for the first time, a dedicated personal-data statute on its books.

Data collected 2026-10-11Data published 2026-10-11

AI-assembled from cited sources

Not covered: Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (3 open gaps).

10 categories · 8 claims · 5 sources in the cumulative register

10Categoriesbaseline.[]

58Sub-modulesbaseline..sub_modules{}

8Claimsbaseline..claims[]

1Tier-1 sourcesrun_metadata.t1_source_count

Traffic-light mix (sums to 10 rendered categories; click to filter)

Jurisdiction lead brief

Latest update · 11 October 2026

Lead Signal

The Marshall Islands enacted its first dedicated data-protection statute this cycle: the Personal Data Protection Act 2025 (6 MIRC Ch.4) establishes an enabling legal framework to protect the personal data and privacy of natural persons in the Republic, with the Executive Property and Social Security Office, EPSSO, designated as the competent authority. The scope of the Act is narrow in a way that matters substantially for anyone assessing the jurisdiction's overall data-protection posture: it applies only to core Government ministries and agencies, leaving the private sector, including commercial data processing of any kind, outside the Act's reach entirely. The citation and scope are drawn from the primary statute text itself, though the specific provision designating EPSSO as competent authority was not independently pinpointed this cycle.

Outside the new Act, the private sector in the Marshall Islands continues to rely on a narrow set of residual legal protections that predate any dedicated data-protection framework. Section 250.12 of the Criminal Code 2011 criminalises unlawful eavesdropping, surveillance and breach of the privacy of messages as a misdemeanour, and Article II of the Constitution guarantees a general right to personal privacy. These remain, as understood from secondary legal commentary, the only privacy-related provisions with any application to the private sector, a gap the new Act does not close.

Other Developments

No breach-notification duty in any sector. No personal-data breach-notification duty, whether to a regulator or to affected individuals, with any specified deadline, was located in Marshall Islands law for any sector, including for entities such as gambling operators that process significant volumes of personal data. This is a negative finding reached through direct examination of the primary statute text, not a research gap: the Act contains no such provision for the government sector it covers, and no equivalent private-sector instrument was located either.

A narrow confidentiality duty on government-engaged personnel. Section 408 of the Personal Data Protection Act 2025 provides that any director, employee, consultant, or other legal or natural person engaged by the competent authority under the relevant chapter must maintain confidentiality of personal data obtained in the performance of their duties. This is a confirmed, directly quoted statutory provision, but its application is limited strictly to personnel engaged by the competent authority itself, rather than extending to controllers or processors more broadly across government, let alone the private sector.

Government remedies exclude compensation. The Act provides remedies for contraventions by core Government ministries and agencies, but a secondary source indicates these remedies expressly exclude compensatory relief against government agencies themselves. The specific provision number for this exclusion was not independently pinpointed this cycle, and the underlying evidence for this claim was assessed as not yet fully evidenced against the primary text.

Cross-Monitor Connections

The narrow, government-sector-only scope of the Marshall Islands' new data-protection framework is relevant context for the financial-integrity and world-payments monitors' parallel coverage of the jurisdiction's evolving financial-sector institutional architecture, including the newly established Marshall Islands Monetary Authority and the USDM1 digital-asset programme: personal data processed by private-sector financial institutions, money-service businesses, or payment providers operating in the Marshall Islands falls outside the Personal Data Protection Act's scope entirely, meaning any data-protection obligations touching those sectors must currently be found, if at all, in the residual Criminal Code and constitutional provisions described above rather than in a sector-specific or general private-sector data-protection regime.

Outlook

A secondary tracker reports that the Act may take effect approximately twelve months after certification, which would place full commencement around November 2026, but this could not be confirmed against the primary text's own commencement clause this cycle. The central open question for Marshall Islands data protection going forward is whether the government intends to extend any form of data-protection regulation to the private sector beyond the current narrow, government-only framework, a question the enacted Act does not itself answer.

Standing brief · as of 4 October 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

The Marshall Islands has, for the first time, a dedicated personal-data statute on its books. Primary legislative text obtained from the RMI Parliament (Nitijela) confirms that the Personal Data Protection Act 2025 is in force and imposes a concrete, dated compliance duty: core Government ministries and agencies must inform the competent authority on a yearly basis, by 1 July of each year, of the information and actions specified in the Act. The Act's own text, however, also confirms that its material scope runs to core Government ministries and agencies, not to the private sector generally. This is a structural fact rather than an incidental drafting choice: the Marshall Islands moves from having no personal-data-protection statute at all to having a public-sector-only one, and the distance between those two positions is the entire story this cycle.

A second-tier commercial tracker separately asserts that there is no general personal data protection law in the jurisdiction. Read together with the primary text, this is not a contradiction so much as a scope clarification: the 2025 Act exists, is in force, and is binding on the government bodies it names, while the broader claim that there is no general law continues to hold for the private sector, which the Act does not appear to reach.

Other Developments

An annual reporting duty with a liability-protection concept attached. Beyond the headline annual filing obligation, the primary text also establishes what has been described as a section 415 safe-harbor liability-protection concept for bodies subject to the Act. The precise mechanics of how this protection operates, and against what, were not resolved from the text retrieved this cycle; the duty to report annually by 1 July is the confirmed element, and the safe-harbor concept is noted as a related feature of the same controller/processor architecture rather than as a separately verified obligation.

A secondary account of a wider 2025 digital-law package remains uncorroborated. A digital-policy tracker describes the Marshall Islands as having adopted a compact but consequential package of digital laws in 2025, which would sit alongside the Personal Data Protection Act. That broader package has not been independently verified against primary RMI Parliament text this cycle, and is therefore not treated here as established alongside the confirmed Act.

Cross-Monitor Connections

The emergence of a government-facing data-protection statute in a jurisdiction otherwise known chiefly for its open corporate and ship registries is a detail of interest to the financial-integrity monitor, where the same registry architecture has been the subject of sustained attention this cycle; the two monitors are tracking different instruments in the same jurisdiction and the data-protection finding does not alter the financial-integrity picture, but the coincidence of a maturing public-sector data regime alongside persistent corporate-registry opacity is worth noting as parallel, not connected, developments.

Outlook

The open question carried into the next cycle is whether the Personal Data Protection Act 2025's core-Government scope is the Act's permanent and complete reach, as its purpose clause suggests, or whether further implementing provisions extend obligations toward private-sector controllers. Until that is resolved against primary text, the Marshall Islands should be read as having a narrow, public-sector personal-data statute with a confirmed annual reporting cadence, sitting inside a jurisdiction that otherwise has no general data-protection law.

10 of 10 categories

Signal

Density

Selections OR within a group, AND across groups. Press / to search.

#

No omnibus instrument and no general supervisory authority; only constitutional/criminal-law and sectoral fragments found.

Traffic-light rationale — RedNo omnibus instrument and no general supervisory authority; only constitutional/criminal-law and sectoral fragments found.

Sub-modules (5)

Regulator And AuthorityRed

No general data protection authority exists in RMI.

Claims (1):

The Republic of the Marshall Islands does not have a general data protection authority.

Act And InstrumentsRed

No general personal data protection law exists; searched for an RMI omnibus DP act, a DPA-enabling statute, and any pending bill — none located.

Claims (1):

The Republic of the Marshall Islands does not have a general/omnibus personal data protection law.

Material ScopeAmber

Material scope of privacy protection is defined only by the Constitution (general privacy right) and the Criminal Code 2011 (specific intrusion offences), not by any data-processing-specific statute.

Claims (2):

Section 13 of the Constitution of the Republic of the Marshall Islands provides a general right to be free from unreasonable interference in personal choices and from unreasonable intrusions into privacy, operating as the sole constitutional-level privacy protection absent any data-processing statute.
Section 250.12 of the Criminal Code 2011 [31 MIRC Ch.1] covers unlawful eavesdropping or surveillance and breach of privacy of messages, framing such conduct as a criminal offence rather than a data-processing obligation.

Territorial ScopeRed

No territorial-scope / extraterritoriality provision exists because there is no controller-facing DP statute to carry one. Searched RMI Criminal Code, Constitution and sectoral acts for an establishment/targeting test; none found.

Regulator Registration And FilingRed

No registration, notification or filing duty on controllers exists; there is no regulator to register with. Searched for a controller-registration scheme; none found.

Category narrative58 words

The Republic of the Marshall Islands (RMI) has no comprehensive/omnibus data-protection statute and no dedicated data-protection authority. Privacy-adjacent protection exists only as: (i) a constitutional privacy guarantee, (ii) a criminal-law prohibition on specific privacy intrusions, and (iii) fragmented sectoral confidentiality provisions in banking, tax and AML law. No registration/filing regime for controllers exists because no controller-facing statute exists.

Periodic update · new data 2026-10-11

Regulator & Framework

The Marshall Islands now has its first dedicated data-protection statute. The Personal Data Protection Act 2025, codified at 6 MIRC Chapter 4, establishes an enabling legal framework intended to protect the personal data and privacy of natural persons in the Republic. The Executive Property and Social Security Office, EPSSO, is designated as the competent authority responsible for administering the framework, according to the primary statute text retrieved this cycle, although the specific provision designating EPSSO was not independently pinpointed within that text.

The defining feature of this new framework, and the one with the most significant practical implications, is its scope: the Act applies only to core Government ministries and agencies. It is not a general data-protection law of the kind that would cover private-sector controllers and processors, commercial data handling, or data processing by non-governmental organisations. This means that, notwithstanding the enactment of a dedicated statute bearing the title Personal Data Protection Act, the private sector in the Marshall Islands remains without any general data-protection law governing how businesses collect, use, store or share personal data.

Outside the new Act, the private sector continues to rely on a narrow set of pre-existing, non-data-protection-specific legal provisions that happen to touch on privacy. Section 250.12 of the Criminal Code 2011 criminalises unlawful eavesdropping, surveillance and breach of the privacy of messages as a misdemeanour, and Article II of the Constitution guarantees a general right to personal privacy. According to secondary legal commentary, these remain the only private-sector-applicable privacy provisions in Marshall Islands law, a gap the enactment of the 2025 Act does not close.

A secondary tracker reports that the Act's effective date falls approximately twelve months after certification, which would place full commencement around November 2026; this could not be confirmed against the primary text's own commencement clause this cycle, and should be treated as an unconfirmed secondary claim pending verification.

Outlook

The central open question for the Marshall Islands' regulatory framework is whether the government intends, at some future point, to extend data-protection regulation beyond the government sector to cover private-sector controllers and processors. The enacted Act, as currently understood, does not itself signal such an intention, and the residual Criminal Code and constitutional provisions remain the only applicable private-sector privacy protections. Confirmation of the Act's actual commencement date against primary statute text, rather than secondary-source estimation, would also materially clarify the framework's practical timeline.

Sources and claims (4)

UncertainDataGuidance — The Republic of the Marshall Islands does not have a general/omnibus personal data protection law.observed 2026-10-03
UncertainDataGuidance — The Republic of the Marshall Islands does not have a general data protection authority.observed 2026-10-03
UncertainDataGuidance — Section 13 of the Constitution of the Republic of the Marshall Islands provides a general right to be free from unreasonable interference in personal choices and from unreasonable intrusions into privacy, operating as the sole constitutional-level privacy protection absent any data-processing statute.observed 2026-10-03
UncertainRepublic of the Marshall Islands (hosted copy) — Section 250.12 of the Criminal Code 2011 [31 MIRC Ch.1] covers unlawful eavesdropping or surveillance and breach of privacy of messages, framing such conduct as a criminal offence rather than a data-processing obligation.observed 2026-10-03

#

No comprehensive regime; absent_field_provenance applies to the entire module.

Traffic-light rationale — Not assessedNo comprehensive regime; absent_field_provenance applies to the entire module.

Sub-modules (4)

Lawful BasesRed

No enumerated lawful bases exist in RMI law.

Special CategoriesRed

No special/sensitive-category processing rules exist.

Pseudonymisation And AnonymisationRed

No statutory pseudonymisation/anonymisation definitions or safe-harbours exist.

Category narrative47 words

No lawful-basis regime, consent-validity standard, special-category rules, or pseudonymisation/anonymisation safe-harbour exists in RMI law, as there is no general processing statute to carry them. Searched for an RMI data-processing act, EDPB-equivalent guidance, or special-category provision; none found beyond the general constitutional privacy right already recorded under regulator_and_framework.

no periodic updates on record for this sub-brief

#

No comprehensive regime for this module; empty claims with explicit rationale per gap discipline.

Traffic-light rationale — Not assessedNo comprehensive regime for this module; empty claims with explicit rationale per gap discipline.

Sub-modules (5)

Access RightRed

No statutory subject-access-request right exists.

Rectification And ErasureRed

No statutory rectification or erasure right exists.

Restriction And ObjectionRed

No statutory restriction or objection right exists.

Data PortabilityRed

No statutory portability right exists.

Deadlines And Response WindowsRed

No statutory response deadline exists for any data-subject request, as no such request right is created by RMI law.

Category narrative32 words

No subject-access, rectification/erasure, restriction/objection, portability, or statutory response-deadline framework exists in RMI law, as there is no general data-processing statute. Searched for an RMI data-subject-rights provision or minors'-rights age threshold; none found.

#

No comprehensive controller/processor obligations regime identified.

Traffic-light rationale — Not assessedNo comprehensive controller/processor obligations regime identified.

Sub-modules (7)

Accountability And DpiaRed

No accountability principle or DPIA trigger list exists.

Dpo RequirementsRed

No DPO appointment threshold exists.

Ropa RequirementsRed

No records-of-processing duty exists.

Joint Controller ArrangementsRed

No joint-controller or processor-contract mandatory-terms rule exists.

Security MeasuresRed

No general security-of-processing standard exists outside sectoral banking/AML confidentiality provisions (see sectoral_watch).

Breach NotificationRed

No data-protection breach-notification duty (regulator or data-subject facing) exists in RMI law.

Retention And DisposalRed

No general retention-limit or disposal duty exists outside sector-specific record-keeping obligations.

Category narrative52 words

No accountability/DPIA regime, DPO threshold, ROPA duty, processor-contract mandatory-terms rule, or data-protection breach-notification duty exists in RMI law. Searched for an RMI breach-notification rule, DPIA trigger list, and DPO appointment threshold; none found. (Cyber-incident reporting regimes such as NIS2/DORA analogues are out of scope for this producer and are not assessed here.)

Periodic update · new data 2026-10-11

Controller/Processor Duties

The clearest confirmed controller-duty finding this cycle is narrow but directly sourced. Section 408 of the Personal Data Protection Act 2025 provides, in language quoted directly from the primary statute text, that any director, employee, consultant, or other legal or natural person engaged by the competent authority under the relevant chapter must maintain confidentiality of personal data obtained in the performance of their duties. This is a confidentiality obligation attaching specifically to personnel engaged by the competent authority, EPSSO, rather than a general controller or processor duty applying across government bodies more broadly, let alone the private sector.

Beyond this confidentiality provision, the Act does not appear to establish a breach-notification duty. No personal-data breach-notification obligation, whether owed to a regulator or to affected individuals and whether or not accompanied by a specified deadline, was located anywhere in Marshall Islands law for any sector. This includes sectors that might otherwise be expected to carry heightened data-handling obligations, such as gambling operators processing significant volumes of personal data in the course of their operations. This is treated as a genuine negative finding reached through direct examination of the primary statute text, rather than as an unresolved research gap: the Act simply contains no such provision for the government sector it covers, and no equivalent instrument exists for the private sector either.

No data protection impact assessment, DPIA, requirement or data protection officer, DPO, designation requirement was identified in connection with the Act or any other Marshall Islands instrument. These are significant gaps relative to comparative international frameworks, though they should be read in the context of the Act's overall narrow government-sector scope rather than as isolated omissions within an otherwise comprehensive regime.

Outlook

The confidentiality duty under Section 408, while confirmed, is narrow in application and does not substitute for the breach-notification, DPIA or DPO mechanisms that are absent from Marshall Islands law entirely. Any future amendment extending breach-notification obligations, even within the government sector the Act currently covers, would represent a materially significant development for this module, as would any sign of private-sector-directed controller or processor duties being introduced for the first time.

#

No cross-border transfer regime identified for this JID.

Traffic-light rationale — Not assessedNo cross-border transfer regime identified for this JID.

Sub-modules (6)

Transfer MechanismsRed

No statutory transfer mechanism exists.

Adequacy ReceivedRed

No adequacy decision naming RMI was located.

Adequacy GrantedRed

RMI has not granted adequacy to any third regime, as it has no adequacy-conferring instrument.

Sccs And BcrsRed

No SCC or BCR framework is recognised in RMI law.

Transfer Impact AssessmentRed

No TIA requirement exists.

Data LocalisationRed

No data-localisation mandate was located.

Category narrative64 words

RMI has received no adequacy decision from the EU/UK or other regimes and has granted none; no statutory transfer mechanism (SCCs, BCRs, derogations), transfer-impact-assessment duty, or data-localisation mandate exists, as there is no general data-protection statute to carry them. Searched for an RMI transfer-mechanism provision and for RMI's presence on the EU Commission adequacy list; no RMI-specific transfer regime or adequacy listing was located.

#

Partial sectoral coverage (financial sector) only; all other sub-modules are gaps.

Traffic-light rationale — AmberPartial sectoral coverage (financial sector) only; all other sub-modules are gaps.

Sub-modules (8)

Financial Sector OverlayAmber

The Banking Act 1987 [17 MIRC Ch.1], the Income Tax Act 1989 [48 MIRC Ch.1], and the Anti-Money Laundering Regulations 2002 each carry information-confidentiality provisions applicable to banking, tax and AML customer data respectively.

Claims (3):

The Banking Act 1987 [17 MIRC Ch.1] refers broadly to 'information' in a manner that addresses the protection of personal information held by banks, without a defined data-processing test.
The Income Tax Act 1989 [48 MIRC Ch.1] provides for the secrecy of all information concerning individual taxpayers in relation to the Secretary of Finance and every employee of the Department of Finance.
The Anti-Money Laundering Regulations 2002 include provisions governing customer information held by obliged entities in the Marshall Islands.

Health Sector OverlayRed

No health-sector data-confidentiality statute was located.

Telecoms And EprivacyRed

No ePrivacy/telecoms communications-data retention or access regime was located.

Employment DataRed

No employment-context data provision was located.

Credit And ScoringRed

No credit-scoring-specific data rule was located.

EducationRed

No education-sector data rule was located.

InsuranceRed

No insurance-sector data rule was located.

Category narrative36 words

Outside the general-DP gap, RMI maintains fragmented sector-specific confidentiality provisions in banking and tax law and customer-information provisions in its AML regulations. No health, telecoms/ePrivacy, employment-data, credit-scoring, education, insurance, or horizontal data-access/data-sharing (Data-Act-equivalent) regime was located.

Sources and claims (3)

UncertainDataGuidance — The Banking Act 1987 [17 MIRC Ch.1] refers broadly to 'information' in a manner that addresses the protection of personal information held by banks, without a defined data-processing test.observed 2026-10-03
UncertainDataGuidance — The Income Tax Act 1989 [48 MIRC Ch.1] provides for the secrecy of all information concerning individual taxpayers in relation to the Secretary of Finance and every employee of the Department of Finance.observed 2026-10-03
UncertainDataGuidance — The Anti-Money Laundering Regulations 2002 include provisions governing customer information held by obliged entities in the Marshall Islands.observed 2026-10-03

#

No adtech/commercial-privacy regime identified.

Traffic-light rationale — Not assessedNo adtech/commercial-privacy regime identified.

Sub-modules (6)

Cookies And TrackersRed

No cookie/tracker consent provision exists.

Dark PatternsRed

No dark-pattern prohibition was located.

Opt Out SignalsRed

No opt-out-signal recognition rule was located.

Clean Rooms And DcrRed

No clean-room/data-collaboration rule was located.

Cross Context AdvertisingRed

No cross-context-advertising rule was located.

Direct MarketingRed

No direct-marketing consent or suppression rule was located.

Category narrative29 words

No cookie/tracker consent rule, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent/suppression regime exists in RMI law. Searched for an RMI ePrivacy-equivalent or consumer-protection dark-pattern provision; none found.

#

No algorithmic/biometric/surveillance governance regime identified.

Traffic-light rationale — Not assessedNo algorithmic/biometric/surveillance governance regime identified.

Sub-modules (6)

Profiling RestrictionsRed

No profiling-restriction rule exists.

Automated Decision Making TransparencyRed

No ADM-transparency or explanation right exists.

Ai Risk AssessmentsRed

No AI-specific risk-assessment duty or AI Act interface exists for RMI (non-EU JID).

Biometric RegimeRed

No biometric-data processing condition exists.

Genetic DataRed

No genetic-data regime exists.

State Surveillance CarveoutsRed

No codified state-surveillance carve-out or national-security exemption test was located; the Criminal Code 2011 §250.12 surveillance offence (CLM-MH-004) is the only located surveillance-adjacent provision.

Category narrative34 words

No profiling restriction, ADM-transparency right, AI-specific risk-assessment duty, biometric-processing condition, genetic-data rule, or codified state-surveillance carve-out exists in RMI law. Searched for an RMI ADM/Art 22-equivalent provision, AI-specific statute, and biometric/facial-recognition rule; none found.

#

No children/vulnerable-groups data regime identified.

Traffic-light rationale — Not assessedNo children/vulnerable-groups data regime identified.

Sub-modules (5)

Age VerificationRed

No age-verification duty exists.

Minor Profiling BansRed

No minor-profiling prohibition exists.

Education SettingsRed

No education-settings-specific data rule exists.

Dependent AdultsRed

No dependent-adults data protection was located.

Category narrative27 words

No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings data rule, or dependent-adults protection exists in RMI law. Searched for an RMI minors'-data or children's-design-code provision; none found.

#

No general enforcement/redress regime; only a narrow criminal-law penalty exists.

Traffic-light rationale — RedNo general enforcement/redress regime; only a narrow criminal-law penalty exists.

Sub-modules (6)

Regulator Powers And PenaltiesAmber

The Criminal Code 2011 [31 MIRC Ch.1] §250.12 frames unlawful eavesdropping/surveillance and breach of privacy of messages as misdemeanors; there is no administrative-fine regime because there is no DP regulator.

Claims (1):

Criminal Code 2011 [31 MIRC Ch.1] §250.12 frames unlawful eavesdropping or surveillance and breach of privacy of messages as misdemeanors, the sole codified penalty tier for privacy intrusion in RMI law.

Enforcement Activity IndexRed

No data-protection enforcement activity (decisions, fines) was located for RMI in the last 12 months.

Regulator Funding And CapacityRed

Not applicable; no general data-protection regulator exists to fund.

Collective Redress And Class ActionsRed

No collective-redress or class-action mechanism for data-protection claims was located.

Private Right Of ActionRed

No statutory private right of action for data-protection harm was located; civil recourse, if any, would arise only under general tort/constitutional-privacy principles, which were not independently verified in this pass.

Recent Developments 180DRed

Searched for RMI data-protection legislative or enforcement developments in the last 180 days (new statute, DPA announcement, FATF/APG RMI mutual-evaluation update); none found.

Category narrative51 words

No general data-protection regulator exists, so no Art 83/84-style administrative fine tier, cross-border procedural rule, or representative/class-action mechanism for data-protection complaints exists. The only enforcement-adjacent provision located is the Criminal Code 2011 §250.12 misdemeanor penalty for specific privacy intrusions (eavesdropping/surveillance/message-privacy breach). No RMI-specific data-protection enforcement decisions or recent-180-day developments were located.

no periodic updates on record for this sub-brief

Sources and claims (1)

UncertainRepublic of the Marshall Islands (hosted copy) — Criminal Code 2011 [31 MIRC Ch.1] §250.12 frames unlawful eavesdropping or surveillance and breach of privacy of messages as misdemeanors, the sole codified penalty tier for privacy intrusion in RMI law.observed 2026-10-03

No categories match.

Filters combine as OR inside a group and AND across groups.

Publication gate

Blocking. 2 failing check(s).

`schema_valid`	pass
`min_quoted_text_present`	waived — floor 0%
`translation_provenance_recorded`	n/a — no subject in this jurisdiction
`egress_verified`	pass
`min_t1_per_instrument_met`	n/a — no subject in this jurisdiction
`jurisdiction_source_floor_met`	FAIL
`source_tier_integrity_ok`	pass
`manual_override`	FAIL
`tier_a_b_national_primary_pct`	50.0
`aggregator_only_jurisdiction_count`	0

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for MH
Field	Value
`trust.lawyer_review.status`	never_reviewed
`trust.lawyer_review.reviewer`	no reviewer on record
`trust.content_source`	ai_generated

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-20. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 8 claim(s) (8 category placement(s)), 5 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (23 mapped).

Show article map

GDPR article to category mapping
Article	Category	Sub-module
`Art. 5`	Controller/Processor Duties	accountability and dpia
`Art. 6`	Lawful Processing & Special Data	lawful bases
`Art. 7`	Lawful Processing & Special Data	consent thresholds
`Art. 9`	Lawful Processing & Special Data	special categories
`Art. 15`	Data Subject Rights	access right
`Art. 18`	Data Subject Rights	restriction and objection
`Art. 20`	Data Subject Rights	data portability
`Art. 21`	Data Subject Rights	restriction and objection
`Art. 22`	Algorithmic, Biometric & Surveillance Governance	automated decision making transparency
`Art. 25`	Controller/Processor Duties	accountability and dpia
`Art. 28`	Controller/Processor Duties	joint controller arrangements
`Art. 30`	Controller/Processor Duties	ropa requirements
`Art. 32`	Controller/Processor Duties	security measures
`Art. 35`	Controller/Processor Duties	accountability and dpia
`Art. 80`	Enforcement & Redress	collective redress and class actions
`Art. 82`	Enforcement & Redress	private right of action
`Art. 13-14`	Data Subject Rights	access right
`Art. 16-17`	Data Subject Rights	rectification and erasure
`Art. 33-34`	Controller/Processor Duties	breach notification
`Art. 37-39`	Controller/Processor Duties	dpo requirements
`Art. 44-49`	Cross-Border & Adequacy	transfer mechanisms
`Art. 77-79`	Enforcement & Redress	regulator powers and penalties
`Art. 83-84`	Enforcement & Redress	regulator powers and penalties

Self-audit

All 10 modules were surveyed. regulator_and_framework, sectoral_watch (financial_sector_overlay only) and enforcement_and_redress (regulator_powers_and_penalties only) carry T3-sourced claims plus one T1 primary-instrument citation (Criminal Code 2011 PDF, SRC-MH-002); the remaining seven modules (lawful_processing_and_special_data, data_subject_rights, controller_processor_duties, cross_border_and_adequacy, adtech_and_commercial_privacy, algorithmic_biometric_and_surveillance_governance, children_and_vulnerable_groups) and five of six sectoral_watch sub-modules carry no findings and are recorded with explicit absent_field_provenance narratives naming the searches run. No RMI-specific T1 primary text was located for the Constitution, Banking Act 1987, Income Tax Act 1989, or AML Regulations 2002; all four rest on a single T3 secondary summary (DataGuidance).

Unresolved questions (5):

Is there an official RMI gazette or legislative portal (Nitijela / Office of the Attorney-General MIRC compiler) reachable to verify primary text of the Banking Act 1987 [17 MIRC Ch.1], Income Tax Act 1989 [48 MIRC Ch.1], and AML Regulations 2002?
What is the precise commencement date of RMI Constitution Section 13?
Has RMI enacted any data-protection, cybersecurity, or electronic-transactions legislation since the secondary sources surveyed here were last updated?
Does the RMI Banking Commission or any Financial Intelligence Unit publish binding customer-data confidentiality rules beyond the 2002 AML Regulations, and is there a current FATF/APG mutual evaluation of RMI's AML customer-information regime?
Is there any civil (non-criminal) private right of action available under RMI common law/tort principles for invasion of privacy, distinct from the Criminal Code 2011 misdemeanor offence?

Escalate to primary-source review: yes

MH

Jurisdiction lead brief

Latest update · 11 October 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Standing brief · as of 4 October 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

regulator_and_frameworkRegulator & Frameworkred5 sub-modules4 claimsRed▾#

Sub-modules (5)

Regulator And AuthorityRed

Act And InstrumentsRed

Material ScopeAmber

Territorial ScopeRed

Regulator Registration And FilingRed

Regulator & Framework

Outlook

lawful_processing_and_special_dataLawful Processing & Special DataCOVERAGE GAP4 sub-modulesNot assessed▾#

Sub-modules (4)

Lawful BasesRed

Consent ThresholdsRed

Special CategoriesRed

Pseudonymisation And AnonymisationRed

data_subject_rightsData Subject RightsCOVERAGE GAP5 sub-modulesNot assessed▾#

Sub-modules (5)

Access RightRed

Rectification And ErasureRed

Restriction And ObjectionRed

Data PortabilityRed

Deadlines And Response WindowsRed

controller_processor_dutiesController/Processor DutiesCOVERAGE GAP7 sub-modulesNot assessed▾#

Sub-modules (7)

Accountability And DpiaRed

Dpo RequirementsRed

Ropa RequirementsRed

Joint Controller ArrangementsRed

Security MeasuresRed

Breach NotificationRed

Retention And DisposalRed

Controller/Processor Duties

Outlook

cross_border_and_adequacyCross-Border & AdequacyCOVERAGE GAP6 sub-modulesNot assessed▾#

Sub-modules (6)

Transfer MechanismsRed

Adequacy ReceivedRed

Adequacy GrantedRed

Sccs And BcrsRed

Transfer Impact AssessmentRed

Data LocalisationRed

sectoral_watchSectoral Watch8 sub-modules3 claimsAmber▾#

Sub-modules (8)

Financial Sector OverlayAmber

Health Sector OverlayRed

Telecoms And EprivacyRed

Employment DataRed

Credit And ScoringRed

EducationRed

InsuranceRed

Data Access SharingRed

adtech_and_commercial_privacyAdTech & Commercial PrivacyCOVERAGE GAP6 sub-modulesNot assessed▾#

Sub-modules (6)

Cookies And TrackersRed

Dark PatternsRed

Opt Out SignalsRed

Clean Rooms And DcrRed

Cross Context AdvertisingRed

Direct MarketingRed

algorithmic_biometric_and_surveillance_governanceAlgorithmic, Biometric & Surveillance GovernanceCOVERAGE GAP6 sub-modulesNot assessed▾#

Sub-modules (6)

Profiling RestrictionsRed

Automated Decision Making TransparencyRed

Ai Risk AssessmentsRed

Biometric RegimeRed

Genetic DataRed

State Surveillance CarveoutsRed

children_and_vulnerable_groupsChildren & Vulnerable GroupsCOVERAGE GAP5 sub-modulesNot assessed▾#

#

#

#

#

#

#

#

#

#

#