Data Protection Monitor
Global Privacy & Data Protection Intelligence

MH Data Protection & Privacy Regulation

MH schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: Sentinel (AML/CFT), World Payments

Last updated · 10 categories · 21 claims · 9 sources in the cumulative register

The Marshall Islands has, for the first time, a dedicated personal-data statute on its books.

Data collected Data published

AI-assembled from cited sources

Not covered: Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework (4 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureUnregulated gap7 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityDataGuidancePrimary statutory & supervisory perimeter
Next milestone (> 2026-10-26)None scheduledNo dated future statutory milestone on record
Module coverage & confidence7 / 10 modules assessed0 Confirmed · 7 Probable · 0 Uncertain · 3 Not yet assessed

Jurisdiction lead brief

Latest update · 25 October 2026

Lead Signal

The Marshall Islands' Personal Data Protection Act 2025 (PL 2025-43, 6 MIRC Ch.4) is approaching its commencement date. The Act takes effect twelve months after the date of constitutional certification, which the Act itself dates to 7 October 2025, placing the effective date at or around 7 October 2026. The Act designates EPSSO as the competent authority, but its application is confined to core Government ministries and agencies; private-sector processing of personal data sits outside the statute's reach. As commencement nears, the Act's remedies for contraventions by government bodies also come into focus, though those remedies expressly exclude compensatory relief against government agencies, and no penalty schedule applicable to private-sector data handling has been located.

Key regulatory facts for MH
Regulatory DimensionMH Standing Position
JurisdictionMH (MH)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 21 sourced findings)
Regulator & FrameworkNo omnibus instrument and no general supervisory authority; only constitutional/criminal-law and sectoral fragments found.
Lawful Processing & Special DataNo comprehensive regime; absent_field_provenance applies to the entire module.
Data Subject RightsNo comprehensive regime for this module; empty claims with explicit rationale per gap discipline.
Controller/Processor DutiesNo comprehensive controller/processor obligations regime identified.
Primary Instruments CitedDataGuidance, Republic of the Marshall Islands (hosted copy), Nitijela (RMI Parliament), Nitijela (RMI Parliament), MH Official Instrument (dataguidance.com marshall-islands)
Last Confirmed / Updated2026-10-25 (9 sources in cumulative register)

#

No omnibus instrument and no general supervisory authority; only constitutional/criminal-law and sectoral fragments found.

Traffic-light rationale — RedNo omnibus instrument and no general supervisory authority; only constitutional/criminal-law and sectoral fragments found.

Sub-modules (5)

Regulator And AuthorityRed

No general data protection authority exists in RMI.

Claims (2):

  • The Republic of the Marshall Islands does not have a general data protection authority.
  • Personal Data Protection Act 2025 (P.L. 2025-43) — Section 408 imposes a duty of confidentiality on any director, employee, consultant, or other person engaged by the 'competent authority' in respect of personal data obtained while performing duties under the Chapter.

Act And InstrumentsRed

No general personal data protection law exists; searched for an RMI omnibus DP act, a DPA-enabling statute, and any pending bill — none located.

Claims (3):

  • The Republic of the Marshall Islands does not have a general/omnibus personal data protection law.
  • Criminal Code 2011 and the Constitution remain MH's only private-sector-applicable privacy provisions.
  • Personal Data Protection Act 2025 (P.L. 2025-43) — Takes effect twelve months after certification (commencement 2025-10-07, calculated general effect ~2026-10-07); binds core Government ministries and agencies only; EPSSO is competent authority.

Material ScopeAmber

Material scope of privacy protection is defined only by the Constitution (general privacy right) and the Criminal Code 2011 (specific intrusion offences), not by any data-processing-specific statute.

Claims (2):

  • Section 13 of the Constitution of the Republic of the Marshall Islands provides a general right to be free from unreasonable interference in personal choices and from unreasonable intrusions into privacy, operating as the sole constitutional-level privacy protection absent any data-processing statute.
  • Section 250.12 of the Criminal Code 2011 [31 MIRC Ch.1] covers unlawful eavesdropping or surveillance and breach of privacy of messages, framing such conduct as a criminal offence rather than a data-processing obligation.

Territorial ScopeRed

No territorial-scope / extraterritoriality provision exists because there is no controller-facing DP statute to carry one. Searched RMI Criminal Code, Constitution and sectoral acts for an establishment/targeting test; none found.

Regulator Registration And FilingRed

No registration, notification or filing duty on controllers exists; there is no regulator to register with. Searched for a controller-registration scheme; none found.

Category narrative 58 words

The Republic of the Marshall Islands (RMI) has no comprehensive/omnibus data-protection statute and no dedicated data-protection authority. Privacy-adjacent protection exists only as: (i) a constitutional privacy guarantee, (ii) a criminal-law prohibition on specific privacy intrusions, and (iii) fragmented sectoral confidentiality provisions in banking, tax and AML law. No registration/filing regime for controllers exists because no controller-facing statute exists.

Periodic update · new data 2026-10-25

Regulator & Framework

The Personal Data Protection Act 2025 (PL 2025-43, 6 MIRC Ch.4) is the Marshall Islands' only data protection statute, and it is approaching the point at which it becomes legally effective. The Act's own commencement notation provides that it takes effect twelve months after the date of constitutional certification, dated to 7 October 2025, placing the effective date at or around 7 October 2026. The Act designates EPSSO as the competent authority under the statute. Its material scope is limited: the Act binds personal data processed by core Government ministries and agencies only, and that limitation is itself a binding feature of the law rather than an interim gap expected to close. Processing of personal data by private businesses in the Marshall Islands sits outside the Act entirely, and no general data-protection law, dedicated supervisory authority, or private-sector compliance regime exists alongside it.

Outlook

As the commencement date around 7 October 2026 is reached, the Act's government-sector-only principles and associated complaint and remedy provisions become legally operative for the first time, bringing EPSSO's role as competent authority into active use. The structural limitation to core Government ministries and agencies is written into the statute itself, so commencement does not of itself extend the regime to private-sector controllers or processors. Whether a broader, general-application data protection law is contemplated for the private sector remains an open question beyond the scope of the current Act.

1 earlier distinct update(s)
Periodic update · new data 2026-10-11

Regulator & Framework

The Marshall Islands now has its first dedicated data-protection statute. The Personal Data Protection Act 2025, codified at 6 MIRC Chapter 4, establishes an enabling legal framework intended to protect the personal data and privacy of natural persons in the Republic. The Executive Property and Social Security Office, EPSSO, is designated as the competent authority responsible for administering the framework, according to the primary statute text retrieved this cycle, although the specific provision designating EPSSO was not independently pinpointed within that text.

The defining feature of this new framework, and the one with the most significant practical implications, is its scope: the Act applies only to core Government ministries and agencies. It is not a general data-protection law of the kind that would cover private-sector controllers and processors, commercial data handling, or data processing by non-governmental organisations. This means that, notwithstanding the enactment of a dedicated statute bearing the title Personal Data Protection Act, the private sector in the Marshall Islands remains without any general data-protection law governing how businesses collect, use, store or share personal data.

Outside the new Act, the private sector continues to rely on a narrow set of pre-existing, non-data-protection-specific legal provisions that happen to touch on privacy. Section 250.12 of the Criminal Code 2011 criminalises unlawful eavesdropping, surveillance and breach of the privacy of messages as a misdemeanour, and Article II of the Constitution guarantees a general right to personal privacy. According to secondary legal commentary, these remain the only private-sector-applicable privacy provisions in Marshall Islands law, a gap the enactment of the 2025 Act does not close.

A secondary tracker reports that the Act's effective date falls approximately twelve months after certification, which would place full commencement around November 2026; this could not be confirmed against the primary text's own commencement clause this cycle, and should be treated as an unconfirmed secondary claim pending verification.

Outlook

The central open question for the Marshall Islands' regulatory framework is whether the government intends, at some future point, to extend data-protection regulation beyond the government sector to cover private-sector controllers and processors. The enacted Act, as currently understood, does not itself signal such an intention, and the residual Criminal Code and constitutional provisions remain the only applicable private-sector privacy protections. Confirmation of the Act's actual commencement date against primary statute text, rather than secondary-source estimation, would also materially clarify the framework's practical timeline.

Sources and claims (7)
  1. Confirmed DataGuidance — The Republic of the Marshall Islands does not have a general/omnibus personal data protection law. observed
  2. Confirmed DataGuidance — The Republic of the Marshall Islands does not have a general data protection authority. observed
  3. Confirmed DataGuidance — Section 13 of the Constitution of the Republic of the Marshall Islands provides a general right to be free from unreasonable interference in personal choices and from unreasonable intrusions into privacy, operating as the sole constitutional-level privacy protection absent any data-processing statute. observed
  4. Confirmed Republic of the Marshall Islands (hosted copy) — Section 250.12 of the Criminal Code 2011 [31 MIRC Ch.1] covers unlawful eavesdropping or surveillance and breach of privacy of messages, framing such conduct as a criminal offence rather than a data-processing obligation. observed
  5. Probable Nitijela (RMI Parliament) — Personal Data Protection Act 2025 (P.L. 2025-43) — Section 408 imposes a duty of confidentiality on any director, employee, consultant, or other person engaged by the 'competent authority' in respect of personal data obtained while performing duties under the Chapter. observed
  6. Probable Nitijela (RMI Parliament) — Criminal Code 2011 and the Constitution remain MH's only private-sector-applicable privacy provisions. observed
  7. Probable RMI Parliament (Nitijela) — Personal Data Protection Act 2025 (P.L. 2025-43) — Takes effect twelve months after certification (commencement 2025-10-07, calculated general effect ~2026-10-07); binds core Government ministries and agencies only; EPSSO is competent authority. observed

#

No comprehensive regime; absent_field_provenance applies to the entire module.

Traffic-light rationale — RedNo comprehensive regime; absent_field_provenance applies to the entire module.
D2 · Lawful Processing — Full Module Record4 sub-modules · 47 words · 1 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

No comprehensive regime for this module; empty claims with explicit rationale per gap discipline.

Traffic-light rationale — Not assessedNo comprehensive regime for this module; empty claims with explicit rationale per gap discipline.

Sub-modules (5)

Access RightRed

No statutory subject-access-request right exists.

Rectification And ErasureRed

No statutory rectification or erasure right exists.

Restriction And ObjectionRed

No statutory restriction or objection right exists.

Data PortabilityRed

No statutory portability right exists.

Deadlines And Response WindowsRed

No statutory response deadline exists for any data-subject request, as no such request right is created by RMI law.

Category narrative 32 words

No subject-access, rectification/erasure, restriction/objection, portability, or statutory response-deadline framework exists in RMI law, as there is no general data-processing statute. Searched for an RMI data-subject-rights provision or minors'-rights age threshold; none found.

#

No comprehensive controller/processor obligations regime identified.

Traffic-light rationale — RedNo comprehensive controller/processor obligations regime identified.
Periodic update · new data 2026-10-11

Controller/Processor Duties

The clearest confirmed controller-duty finding this cycle is narrow but directly sourced. Section 408 of the Personal Data Protection Act 2025 provides, in language quoted directly from the primary statute text, that any director, employee, consultant, or other legal or natural person engaged by the competent authority under the relevant chapter must maintain confidentiality of personal data obtained in the performance of their duties. This is a confidentiality obligation attaching specifically to personnel engaged by the competent authority, EPSSO, rather than a general controller or processor duty applying across government bodies more broadly, let alone the private sector.

Beyond this confidentiality provision, the Act does not appear to establish a breach-notification duty. No personal-data breach-notification obligation, whether owed to a regulator or to affected individuals and whether or not accompanied by a specified deadline, was located anywhere in Marshall Islands law for any sector. This includes sectors that might otherwise be expected to carry heightened data-handling obligations, such as gambling operators processing significant volumes of personal data in the course of their operations. This is treated as a genuine negative finding reached through direct examination of the primary statute text, rather than as an unresolved research gap: the Act simply contains no such provision for the government sector it covers, and no equivalent instrument exists for the private sector either.

No data protection impact assessment, DPIA, requirement or data protection officer, DPO, designation requirement was identified in connection with the Act or any other Marshall Islands instrument. These are significant gaps relative to comparative international frameworks, though they should be read in the context of the Act's overall narrow government-sector scope rather than as isolated omissions within an otherwise comprehensive regime.

Outlook

The confidentiality duty under Section 408, while confirmed, is narrow in application and does not substitute for the breach-notification, DPIA or DPO mechanisms that are absent from Marshall Islands law entirely. Any future amendment extending breach-notification obligations, even within the government sector the Act currently covers, would represent a materially significant development for this module, as would any sign of private-sector-directed controller or processor duties being introduced for the first time.

D4 · Controller & Processor — Full Module Record7 sub-modules · 52 words · 1 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

No cross-border transfer regime identified for this JID.

Traffic-light rationale — RedNo cross-border transfer regime identified for this JID.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 64 words · 1 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Partial sectoral coverage (financial sector) only; all other sub-modules are gaps.

Traffic-light rationale — AmberPartial sectoral coverage (financial sector) only; all other sub-modules are gaps.
D6 · Sectoral Watch — Full Module Record8 sub-modules · 36 words · 5 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

No adtech/commercial-privacy regime identified.

Traffic-light rationale — Not assessedNo adtech/commercial-privacy regime identified.

Sub-modules (6)

Cookies And TrackersRed

No cookie/tracker consent provision exists.

Dark PatternsRed

No dark-pattern prohibition was located.

Opt Out SignalsRed

No opt-out-signal recognition rule was located.

Clean Rooms And DcrRed

No clean-room/data-collaboration rule was located.

Cross Context AdvertisingRed

No cross-context-advertising rule was located.

Direct MarketingRed

No direct-marketing consent or suppression rule was located.

Category narrative 29 words

No cookie/tracker consent rule, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent/suppression regime exists in RMI law. Searched for an RMI ePrivacy-equivalent or consumer-protection dark-pattern provision; none found.

#

No algorithmic/biometric/surveillance governance regime identified.

Traffic-light rationale — RedNo algorithmic/biometric/surveillance governance regime identified.
D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 34 words · 2 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

No children/vulnerable-groups data regime identified.

Traffic-light rationale — Not assessedNo children/vulnerable-groups data regime identified.

Sub-modules (5)

Age VerificationRed

No age-verification duty exists.

Minor Profiling BansRed

No minor-profiling prohibition exists.

Education SettingsRed

No education-settings-specific data rule exists.

Dependent AdultsRed

No dependent-adults data protection was located.

Category narrative 27 words

No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings data rule, or dependent-adults protection exists in RMI law. Searched for an RMI minors'-data or children's-design-code provision; none found.

#

No general enforcement/redress regime; only a narrow criminal-law penalty exists.

Traffic-light rationale — RedNo general enforcement/redress regime; only a narrow criminal-law penalty exists.
Periodic update · new data 2026-10-25

Enforcement & Redress

The Personal Data Protection Act 2025 sets out remedies for contraventions committed by core Government ministries and agencies, the only bodies the Act binds. Those remedies expressly exclude compensatory relief against government agencies, meaning that even within the Act's own public-sector scope, affected individuals cannot obtain compensation from the government bodies responsible for a contravention. No penalty schedule applicable to private-sector data handling has been located, and, consistent with the Act's scope limitation, no private right of action against commercial controllers exists absent a general data-protection law covering the private sector.

Outlook

As the Act's effective date around 7 October 2026 arrives, its government-sector enforcement and remedy provisions move from statute to active application, giving affected individuals a defined (if compensation-limited) complaint pathway against Government ministries and agencies for the first time. That pathway remains bounded by the exclusion of compensatory relief against government bodies, and it does not create any enforcement or redress mechanism reaching private-sector data handling, which continues to fall outside any statutory scheme.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 51 words · 4 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 21 claim(s) (21 category placement(s)), 9 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 24 Oct 2026: not settled (5 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (23 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 15Data Subject Rightsaccess right
Art. 18Data Subject Rightsrestriction and objection
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 80Enforcement & Redresscollective redress and class actions
Art. 82Enforcement & Redressprivate right of action
Art. 13-14Data Subject Rightsaccess right
Art. 16-17Data Subject Rightsrectification and erasure
Art. 33-34Controller/Processor Dutiesbreach notification
Art. 37-39Controller/Processor Dutiesdpo requirements
Art. 44-49Cross-Border & Adequacytransfer mechanisms
Art. 77-79Enforcement & Redressregulator powers and penalties
Art. 83-84Enforcement & Redressregulator powers and penalties