{"kind":"expression","expression":{"expr_id":"463","doc_id":"463","label":"SL 17 of 2019","is_as_enacted":"t","commenced_on":null,"superseded_on":null,"valid_from":null,"valid_to":null,"is_current":"t","incorporating":null,"akn_expr_iri":"\/akn\/ky\/act\/sl\/2019\/17\/eng@2019-01-01","akn_envelope":"{\"_canary\": {\"iri\": {\"work\": \"\/akn\/ky\/act\/sl\/2019\/17\", \"expression\": \"\/akn\/ky\/act\/sl\/2019\/17\/eng@2019-01-01\", \"manifestation\": \"\/akn\/ky\/act\/sl\/2019\/17\/eng@2019-01-01.pdf\"}, \"pdf\": {\"md5\": \"9f243d2c635dd5d2c4fb2b9c0063df2f\", \"path\": \"\/Users\/q\/kyleg-data\/working\/SUBORDINATE\/2019\/2019-0017\/2019-0017_SL 17 of 2019.pdf\", \"pages\": 8, \"filename\": \"2019-0017_SL 17 of 2019.pdf\"}, \"errors\": [], \"extraction\": {\"model\": null, \"stats\": {\"word_count\": 2082, \"paragraph_count\": 11, \"text_char_count\": 13236}, \"usage\": null, \"method\": \"pymupdf-text\", \"version\": \"kyleg-akn-1.0\", \"extracted_at\": \"2026-06-22\"}, \"classification\": \"text_layer\", \"validation_flags\": [], \"docai_processor_id\": null}, \"akomaNtoso\": {\"act\": {\"body\": [{\"eId\": \"sec_n1\", \"num\": null, \"text\": \"Data Protection Law, 2017 (Law 33 of 2017) THE DATA PROTECTION REGULATIONS, 2018 (SL 17 of 2019) PUBLISHING DETAILS The Data Protection Regulations, 2018 Arrangement of Regulations Data Protection Law, 2017 (Law 33 of 2017) THE DATA PROTECTION REGULATIONS, 2018 Arrangement of Regulations Regulation 1. 2. 3. 4. 5. 6. 7. 8. 9.\", \"element\": \"section\", \"heading\": null}, {\"eId\": \"sec_10\", \"num\": \"10.\", \"text\": \"Exceptions to the Eighth principle - international co-operation between intelligence and The Data Protection Regulations, 2018 Regulation 1 Data Protection Law, 2017 (Law 33 of 2017) THE DATA PROTECTION REGULATIONS, 2018 The Cabinet, in exercise of the powers conferred by section 61 of the Data Protection Law, 2017, makes the following Regulations \u2014\", \"element\": \"section\", \"heading\": null}, {\"eId\": \"sec_1\", \"num\": \"1.\", \"text\": \"Citation 1. (1) These Regulations may be cited as the Data Protection Regulations, 2018. (2) These Regulations come into force immediately after the Data Protection Law, 2017 comes into force.\", \"element\": \"section\", \"heading\": null}, {\"eId\": \"sec_2\", \"num\": \"2.\", \"text\": \"Definitions 2. In these Regulations, \u2014 \u201cchild\u201d means a person under the age of eighteen years; \u201ceducational record\u201d means a record of information that \u2014 (a) is processed by or on behalf of the proprietor or a teacher at a school; (b) relates to a person who is or has been a pupil at the school; and (c) originated from or was supplied by or on behalf of any of the following persons \u2014 (i) a teacher or other employee at the school; (ii) a person who is engaged by the proprietor of the school under a contract for the provision of educational services; (iii) the pupil to whom the record relates; or (iv) a parent of that pupil; and \u201cparent\u201d in relation to a pupil, includes a guardian and any person who has custody of the pupil.\", \"element\": \"section\", \"heading\": null}, {\"eId\": \"sec_3\", \"num\": \"3.\", \"text\": \"Fees for requests 3. (1) Personal data and information pursuant to a request under section 8 shall be provided free of charge, except that where the request from a data subject is determined to be manifestly unfounded or excessive because the request \u2014 (a) is repetitive; (b) is fraudulent in nature; or (c) would divert the resources of the data controller unreasonably, Regulation 4 The Data Protection Regulations, 2018 the data controller may charge such fee as covers the cost of providing the requested data and information or may refuse to act on the request and provide the reasons for doing so. (2) The burden of proving that the request was \u201cmanifestly unfounded\u201d or \u201cexcessive\u201d is on the data controller. (3) Where personal data are \u2014 (a) open to access by the public pursuant to any other enactment as part of a public register or otherwise; or (b) available for purchase by the public in accordance with administrative procedures established for that purpose, access to that data shall be obtained in accordance with the provisions of that enactment or those administrative procedures. (4) Where a data controller charges a fee pursuant to paragraph (1), the fee shall be reasonable taking into account the administrative cost of providing the personal data or information requested.\", \"element\": \"section\", \"heading\": null}, {\"eId\": \"sec_4\", \"num\": \"4.\", \"text\": \"Extension of time for response 4. (1) A data controller may extend the time for responding to a subject access request under section 8 by up to thirty days where one or more of the following conditions apply \u2014 (a) a large amount of data is requested or is required to be searched and meeting the timelines would unreasonably interfere with the operations of the data controller; (b) more time is required to consult with a third party or other data controller before the data controller is able to decide whether or not to give the data subject access to the requested data; or (c) the data subject has given consent to the extension. (2) With the permission of the Ombudsman, the data controller may extend the time for responding to a subject access request under section 8 \u2014 (a) for a period longer than thirty days, where one or more of the circumstances described in paragraphs (1)(a) to (c) apply; and (b) where the Ombudsman otherwise considers that it is appropriate to do so. (3) Where the time for responding to a request is extended under this regulation, the data controller shall inform the data subject of the reason for the extension and when a final response will be given.\", \"element\": \"section\", \"heading\": null}, {\"eId\": \"sec_5\", \"num\": \"5.\", \"text\": \"Data controller\u2019s duty to inform data subject of right to complain 5. Where a request under section 8 is received from a data subject, the data controller shall inform the data subject of the right to complain to the Ombudsman under section 43 of the Law.\", \"element\": \"section\", \"heading\": null}, {\"eId\": \"sec_6\", \"num\": \"6.\", \"text\": \"Circumstances when data controller not obliged to comply 6. (1) Without limiting sections 10(2)(a) to (c) of the Law, a data controller shall comply with a request under section 10(1) unless the data controller has applied to the Ombudsman within twenty-one days of the date of the request by the data subject and has received approval from the Ombudsman to not comply with the data subject\u2019s request to cease processing. (2) The data controller shall inform the data subject of any application made to the Ombudsman under paragraph (1).\", \"element\": \"section\", \"heading\": null}, {\"eId\": \"sec_7\", \"num\": \"7.\", \"text\": \"Health exemption 7. (1) Personal data, the release of which could reasonably cause mental or physical harm to the data subject or any other person, shall be exempt from the subject information provisions. (2) A data controller who is not a health professional shall not, on the ground of the exemption under paragraph (1), refuse a request for information under this regulation unless \u2014 The Data Protection Regulations, 2018 Regulation 8 (a) after receiving the request, the data controller consults the appropriate health professional on the question of whether the exemption applies  and obtains in writing from the health professional an opinion that the exemption applies to the information; or (b) the following conditions are satisfied \u2014 (i) the data controller consulted a health professional before receiving the request; (ii) the health professional was the person who would have been the appropriate health professional, if the data controller had carried out the consultation under subparagraph (a); and (iii) the data controller obtained from the health professional an opinion in writing that the exemption applied to all of the information. (3) The conditions referred to in paragraph (2) are not satisfied if \u2014 (a) the opinion was obtained before the start of the period of six months that ends on the day that the request is made; or (b) the opinion was obtained within the period in paragraph (a) but it is reasonable in all the circumstances to consult the appropriate health professional again.\", \"element\": \"section\", \"heading\": null}, {\"eId\": \"sec_8\", \"num\": \"8.\", \"text\": \"Education exemption 8. (1) Personal data that consist of information that constitutes an educational record are exempt from section 8 of the Law to the extent that the application of that section would be likely to cause serious harm to the physical or mental health or condition of the data subject or any other person. (2) Where a parent, or someone who has been appointed by the court to manage the affairs of a person who is the data subject, is enabled to make a request under section 8 of the Law on behalf of a data subject and has made such a request, personal data that consist of information specified in paragraph (3) are exempt from the provisions in section 8 of the Law to the extent that the application of that section would not be in the interests of the data subject. (3) For the purposes of paragraph (2), the personal data are data consisting of information constituting an educational record or information about whether the data subject, where the subject is a child, is or has been the subject of abuse or may be at risk of it. (4) Personal data that may reveal a record of a question that is reasonably expected to be used on an examination or test within twelve months from the date of the request are exempt from the provisions under section 8. (5) For the purposes of this regulation, \u201cabuse\u201d in respect of a person when that person is a child \u2014 (a) includes physical injury to and physical neglect, emotional neglect, ill-treatment and sexual abuse of the person; and (b) excludes accidental injury.\", \"element\": \"section\", \"heading\": null}, {\"eId\": \"sec_9\", \"num\": \"9.\", \"text\": \"Social work exemption 9. (1) The personal data specified in paragraph (5) are exempt from the subject information provisions to the extent that the application of those provisions would be likely to prejudice the carrying out of social work by reason of the fact that serious harm to the physical or mental health or condition of the data subject or any other person would be likely. (2) In a case where a defined person is enabled by or under any enactment or rule of law to make a request under section 8 of the Law on behalf of a data subject and has made such a request, personal data specified in paragraphs (5)(a) or (b) are exempt from the provisions under section 8 of the Law to the extent that the application of that section would result in the disclosure of information \u2014 (a) provided by the data subject in the expectation that it would not be disclosed to the person making the request; Regulation 10 The Data Protection Regulations, 2018 (b) obtained as a result of any examination or investigation to which the data subject consented in the expectation that the information would not be so disclosed; or (c) that the data subject has expressly indicated should not be so disclosed. (3) Paragraphs (2)(a) and (b) do not apply to the extent that the data subject has expressly indicated that the data subject no longer has the expectation that the information would not be disclosed. (4) For the purposes of paragraph (2), a \u201cdefined person\u201d is a person who \u2014 (a) has parental responsibility for a child who is the data subject; or (b) has been appointed by a court to manage the affairs of a person who is the data subject and incapable of managing his or her own affairs. (5) The personal data referred to in paragraph (1) are \u2014 (a) personal data processed by a public authority in relation to any of the following matters \u2014 (i) the allocation of housing or other residential accommodation; (ii) the provision of any benefit under the Health Insurance Law (2018 Revision) or the Poor Persons (Relief) Law (1997 Revision); (iii) probation; (iv) school attendance; (v) ensuring that children receive suitable education whether by attendance at school or otherwise; (vi) guardianship under the Grand Court Law (2015 Revision); or (vii) any function under the Children Law (2012 Revision), Adoption of Children Law (2003 Revision), Mental Health Law, 2013, the Older Persons Law, 2017 or any other applicable law; or (b) personal data processed by a court and consisting of information that \u2014 (i) is supplied in a report to or other evidence given to the court in the course of proceedings relating to families or children; and (ii) the court directs should be withheld from the data subject on the ground that it appears \u2014 (A) to be impracticable to disclose the report or other evidence having regard to the data subject\u2019s age and understanding; or (B) to be undesirable to disclose the report or other evidence having regard to the serious harm that might be suffered by the data subject by the disclosure. (6) For the purposes of this regulation, \u201cproceedings relating to families or children\u201d includes proceedings relating to adoption, matrimonial matters or guardianship. 10. Exceptions to the Eighth principle - international co-operation between intelligence and regulatory agencies 10. A transfer for the purposes of international cooperation between intelligence or regulatory agencies as set out in paragraph 10 of Schedule 4 of the Law is limited to a disclosure that is permitted or required under an enactment in force in the Islands or an order issued by the Grand Court. Made in the Cabinet the 28th day of August, 2018. Kim Bullings Clerk of the Cabinet.\", \"element\": \"section\", \"heading\": null}], \"meta\": {\"notes\": null, \"workflow\": null, \"lifecycle\": {\"source\": \"#cilegis\", \"eventRef\": [{\"eId\": \"e_commence_2019_01_01\", \"date\": \"2019-01-01\", \"type\": \"generation\", \"source\": \"#cilegis\"}]}, \"references\": {\"source\": \"#canary\", \"TLCRole\": [], \"TLCEvent\": [{\"eId\": \"ev_commencement\", \"href\": \"\/akn\/ontology\/canary\/event\/commencement\", \"showAs\": \"commencement\"}], \"TLCPerson\": [], \"TLCConcept\": [{\"eId\": \"inForce\", \"href\": \"\/akn\/ontology\/canary\/concept\/temporal\/in-force\", \"showAs\": \"in force\"}], \"TLCProcess\": [], \"TLCLocation\": [], \"TLCOrganization\": [{\"eId\": \"cilegis\", \"href\": \"\/akn\/ontology\/canary\/organization\/editor\/cilegis\", \"showAs\": \"Cayman Islands legislation mirror (kyleg)\"}]}, \"temporalData\": {\"source\": \"#cilegis\", \"temporalGroup\": [{\"eId\": \"tg_inforce_2019_01_01\", \"timeInterval\": [{\"end\": null, \"start\": \"#e_commence_2019_01_01\", \"duration\": null, \"refersTo\": \"#inForce\"}]}]}, \"classification\": null, \"identification\": {\"source\": \"#cilegis\", \"FRBRWork\": {\"FRBRuri\": \"\/akn\/ky\/act\/sl\/2019\/17\", \"FRBRdate\": [{\"date\": \"2019-01-01\", \"name\": \"generation\"}], \"FRBRthis\": \"\/akn\/ky\/act\/sl\/2019\/17\/!main\", \"FRBRalias\": [{\"name\": \"cmsId\", \"value\": \"2019-0017\"}], \"FRBRauthor\": [{\"as\": \"#editor\", \"href\": \"\/akn\/ontology\/canary\/organization\/editor\/cilegis\"}], \"FRBRnumber\": \"17 of 2019\", \"FRBRcountry\": \"ky\", \"FRBRsubtype\": \"subordinate\"}, \"FRBRExpression\": {\"FRBRuri\": \"\/akn\/ky\/act\/sl\/2019\/17\/eng@2019-01-01\", \"FRBRdate\": [{\"date\": \"2019-01-01\", \"name\": \"generation\"}], \"FRBRthis\": \"\/akn\/ky\/act\/sl\/2019\/17\/eng@2019-01-01\/!main\", \"FRBRauthor\": [{\"as\": \"#editor\", \"href\": \"\/akn\/ontology\/canary\/organization\/editor\/cilegis\"}], \"FRBRlanguage\": \"eng\"}, \"FRBRManifestation\": {\"FRBRuri\": \"\/akn\/ky\/act\/sl\/2019\/17\/eng@2019-01-01.xml\", \"FRBRdate\": [{\"date\": \"2026-06-22\", \"name\": \"generation\"}], \"FRBRthis\": \"\/akn\/ky\/act\/sl\/2019\/17\/eng@2019-01-01.xml\", \"FRBRauthor\": [{\"as\": \"#editor\", \"href\": \"\/akn\/ontology\/canary\/organization\/editor\/cilegis\"}], \"FRBRformat\": \"application\/xml\"}}}, \"name\": \"act\", \"header\": {\"title\": \"Data Protection Regulations\", \"actNumber\": \"17 of 2019\", \"longTitle\": null}}, \"doc\": null, \"bill\": null, \"judgment\": null}}","akn_full_text":"CAYMAN ISLANDS\n\nData Protection Law, 2017\n(Law 33 of 2017)\nTHE DATA PROTECTION REGULATIONS, 2018\n\n (SL 17 of 2019)\n Supplement No. 2 published with Legislation Gazette No. 9 dated 2nd April, 2019\n\nPage 2\n\nc\n\nPUBLISHING DETAILS\n\nThe Data Protection Regulations, 2018\nArrangement of Regulations\n\nc\n\nPage 3\n\nCAYMAN ISLANDS\n\nData Protection Law, 2017\n(Law 33 of 2017)\nTHE DATA PROTECTION REGULATIONS, 2018\n\nArrangement of Regulations\nRegulation\nPage\n1.\nCitation .......................................................................................................................................... 5\n2.\nDefinitions ..................................................................................................................................... 5\n3.\nFees for requests ............................................................................................................................ 5\n4.\nExtension of time for response ...................................................................................................... 6\n5.\nData controller\u2019s duty to inform data subject of right to complain ............................................... 6\n6.\nCircumstances when data controller not obliged to comply.......................................................... 6\n7.\nHealth exemption .......................................................................................................................... 6\n8.\nEducation exemption ..................................................................................................................... 7\n9.\nSocial work exemption .................................................................................................................. 7\n10. Exceptions to the Eighth principle - international co-operation between intelligence and\nregulatory agencies ........................................................................................................................ 8\n\nThe Data Protection Regulations, 2018\nRegulation 1\n\nc\n\nPage 5\n\nCAYMAN ISLANDS\n\nData Protection Law, 2017\n(Law 33 of 2017)\nTHE DATA PROTECTION REGULATIONS, 2018\n\nThe Cabinet, in exercise of the powers conferred by section 61 of the Data Protection Law, 2017, makes\nthe following Regulations \u2014\n1.\nCitation\n1.\n(1) These Regulations may be cited as the Data Protection Regulations, 2018.\n(2) These Regulations come into force immediately after the Data Protection Law, 2017 comes into\nforce.\n2.\nDefinitions\n2.\nIn these Regulations, \u2014\n\u201cchild\u201d means a person under the age of eighteen years;\n\u201ceducational record\u201d means a record of information that \u2014\n(a) is processed by or on behalf of the proprietor or a teacher at a school;\n(b) relates to a person who is or has been a pupil at the school; and\n(c) originated from or was supplied by or on behalf of any of the following\npersons \u2014\n(i) a teacher or other employee at the school;\n(ii) a person who is engaged by the proprietor of the school under a contract for\nthe provision of educational services;\n(iii) the pupil to whom the record relates; or\n(iv) a parent of that pupil; and\n\u201cparent\u201d in relation to a pupil, includes a guardian and any person who has custody of the pupil.\n3.\nFees for requests\n3.\n(1) Personal data and information pursuant to a request under section 8 shall be provided free of\ncharge, except that where the request from a data subject is determined to be manifestly\nunfounded or excessive because the request \u2014\n(a) is repetitive;\n(b) is fraudulent in nature; or\n(c) would divert the resources of the data controller unreasonably,\n\nRegulation 4\nThe Data Protection Regulations, 2018\n\nPage 6\n\nc\n\nthe data controller may charge such fee as covers the cost of providing the requested data and\ninformation or may refuse to act on the request and provide the reasons for doing so.\n(2) The burden of proving that the request was \u201cmanifestly unfounded\u201d or \u201cexcessive\u201d is on the\ndata controller.\n(3) Where personal data are \u2014\n(a) open to access by the public pursuant to any other enactment as part of a public register or\notherwise; or\n(b) available for purchase by the public in accordance with administrative procedures\nestablished for that purpose,\naccess to that data shall be obtained in accordance with the provisions of that enactment or those\nadministrative procedures.\n(4) Where a data controller charges a fee pursuant to paragraph (1), the fee shall be reasonable\ntaking into account the administrative cost of providing the personal data or information\nrequested.\n4.\nExtension of time for response\n4.\n(1) A data controller may extend the time for responding to a subject access request under section 8\nby up to thirty days where one or more of the following conditions apply \u2014\n(a) a large amount of data is requested or is required to be searched and meeting the timelines\nwould unreasonably interfere with the operations of the data controller;\n(b) more time is required to consult with a third party or other data controller before the data\ncontroller is able to decide whether or not to give the data subject access to the requested\ndata; or\n(c) the data subject has given consent to the extension.\n(2) With the permission of the Ombudsman, the data controller may extend the time for responding\nto a subject access request under section 8 \u2014\n(a) for a period longer than thirty days, where one or more of the circumstances described in\nparagraphs (1)(a) to (c) apply; and\n(b) where the Ombudsman otherwise considers that it is appropriate to do so.\n(3) Where the time for responding to a request is extended under this regulation, the data controller\nshall inform the data subject of the reason for the extension and when a final response will be\ngiven.\n5.\nData controller\u2019s duty to inform data subject of right to complain\n5.\nWhere a request under section 8 is received from a data subject, the data controller shall inform the\ndata subject of the right to complain to the Ombudsman under section 43 of the Law.\n6.\nCircumstances when data controller not obliged to comply\n6.\n(1) Without limiting sections 10(2)(a) to (c) of the Law, a data controller shall comply with a\nrequest under section 10(1) unless the data controller has applied to the Ombudsman within\ntwenty-one days of the date of the request by the data subject and has received approval from\nthe Ombudsman to not comply with the data subject\u2019s request to cease processing.\n(2) The data controller shall inform the data subject of any application made to the Ombudsman\nunder paragraph (1).\n7.\nHealth exemption\n7.\n(1) Personal data, the release of which could reasonably cause mental or physical harm to the data\nsubject or any other person, shall be exempt from the subject information provisions.\n(2) A data controller who is not a health professional shall not, on the ground of the exemption\nunder paragraph (1), refuse a request for information under this regulation unless \u2014\n\nThe Data Protection Regulations, 2018\nRegulation 8\n\nc\n\nPage 7\n\n(a) after receiving the request, the data controller consults the appropriate health professional\non the question of whether the exemption applies  and obtains in writing from the health\nprofessional an opinion that the exemption applies to the information; or\n(b) the following conditions are satisfied \u2014\n(i) the data controller consulted a health professional before receiving the request;\n(ii) the health professional was the person who would have been the appropriate health\nprofessional, if the data controller had carried out the consultation under\nsubparagraph (a); and\n(iii) the data controller obtained from the health professional an opinion in writing that the\nexemption applied to all of the information.\n(3) The conditions referred to in paragraph (2) are not satisfied if \u2014\n(a) the opinion was obtained before the start of the period of six months that ends on the day\nthat the request is made; or\n(b) the opinion was obtained within the period in paragraph (a) but it is reasonable in all the\ncircumstances to consult the appropriate health professional again.\n8.\nEducation exemption\n8.\n(1) Personal data that consist of information that constitutes an educational record are exempt from\nsection 8 of the Law to the extent that the application of that section would be likely to cause\nserious harm to the physical or mental health or condition of the data subject or any other\nperson.\n(2) Where a parent, or someone who has been appointed by the court to manage the affairs of a\nperson who is the data subject, is enabled to make a request under section 8 of the Law on\nbehalf of a data subject and has made such a request, personal data that consist of information\nspecified in paragraph (3) are exempt from the provisions in section 8 of the Law to the extent\nthat the application of that section would not be in the interests of the data subject.\n(3) For the purposes of paragraph (2), the personal data are data consisting of information\nconstituting an educational record or information about whether the data subject, where the\nsubject is a child, is or has been the subject of abuse or may be at risk of it.\n(4) Personal data that may reveal a record of a question that is reasonably expected to be used on an\nexamination or test within twelve months from the date of the request are exempt from the\nprovisions under section 8.\n(5) For the purposes of this regulation, \u201cabuse\u201d in respect of a person when that person is a child \u2014\n(a) includes physical injury to and physical neglect, emotional neglect, ill-treatment and sexual\nabuse of the person; and\n(b) excludes accidental injury.\n9.\nSocial work exemption\n9.\n(1) The personal data specified in paragraph (5) are exempt from the subject information provisions\nto the extent that the application of those provisions would be likely to prejudice the carrying\nout of social work by reason of the fact that serious harm to the physical or mental health or\ncondition of the data subject or any other person would be likely.\n(2) In a case where a defined person is enabled by or under any enactment or rule of law to make a\nrequest under section 8 of the Law on behalf of a data subject and has made such a request,\npersonal data specified in paragraphs (5)(a) or (b) are exempt from the provisions under\nsection 8 of the Law to the extent that the application of that section would result in the\ndisclosure of information \u2014\n(a) provided by the data subject in the expectation that it would not be disclosed to the person\nmaking the request;\n\nRegulation 10\nThe Data Protection Regulations, 2018\n\nPage 8\n\nc\n\n(b) obtained as a result of any examination or investigation to which the data subject consented\nin the expectation that the information would not be so disclosed; or\n(c) that the data subject has expressly indicated should not be so disclosed.\n(3) Paragraphs (2)(a) and (b) do not apply to the extent that the data subject has expressly indicated\nthat the data subject no longer has the expectation that the information would not be disclosed.\n(4) For the purposes of paragraph (2), a \u201cdefined person\u201d is a person who \u2014\n(a) has parental responsibility for a child who is the data subject; or\n(b) has been appointed by a court to manage the affairs of a person who is the data subject and\nincapable of managing his or her own affairs.\n(5) The personal data referred to in paragraph (1) are \u2014\n(a) personal data processed by a public authority in relation to any of the following matters \u2014\n(i) the allocation of housing or other residential accommodation;\n(ii) the provision of any benefit under the Health Insurance Law (2018 Revision) or the\nPoor Persons (Relief) Law (1997 Revision);\n(iii) probation;\n(iv) school attendance;\n(v) ensuring that children receive suitable education whether by attendance at school or\notherwise;\n(vi) guardianship under the Grand Court Law (2015 Revision); or\n(vii) any function under the Children Law (2012 Revision), Adoption of Children Law\n(2003 Revision), Mental Health Law, 2013, the Older Persons Law, 2017 or any other\napplicable law; or\n(b) personal data processed by a court and consisting of information that \u2014\n(i) is supplied in a report to or other evidence given to the court in the course of\nproceedings relating to families or children; and\n(ii) the court directs should be withheld from the data subject on the ground that it\nappears \u2014\n(A) to be impracticable to disclose the report or other evidence having regard to the\ndata subject\u2019s age and understanding; or\n(B) to be undesirable to disclose the report or other evidence having regard to the\nserious harm that might be suffered by the data subject by the disclosure.\n(6) For the purposes of this regulation, \u201cproceedings relating to families or children\u201d includes\nproceedings relating to adoption, matrimonial matters or guardianship.\n10.\nExceptions to the Eighth principle - international co-operation between intelligence and regulatory\nagencies\n10. A transfer for the purposes of international cooperation between intelligence or regulatory agencies\nas set out in paragraph 10 of Schedule 4 of the Law is limited to a disclosure that is permitted or\nrequired under an enactment in force in the Islands or an order issued by the Grand Court.\n\nMade in the Cabinet the 28th day of August, 2018.\n\nKim Bullings\n\nClerk of the Cabinet.","akn_extracted_at":"2026-06-22 15:38:20.594559+00","cms_id":"2019-0017","law_type":"subordinate","year":"2019","number":"17","title":"Data Protection Regulations","status":"in_force"},"provenance":{"files":[{"file_id":"5442","expr_id":"463","kind":"akn_xml","filename":"2019-0017_SL 17 of 2019.akn.xml","source_url":null,"storage_path":"\/Users\/q\/kyleg-data\/working\/SUBORDINATE\/2019\/2019-0017\/2019-0017_SL 17 of 2019.akn.xml","content_md5":"f11744f89896f0168acee46e5678568e","byte_size":"15465","http_last_modified":null,"fetched_at":"2026-06-22 15:38:20.705872+00"},{"file_id":"925","expr_id":"463","kind":"pristine_pdf","filename":"2019-0017_SL 17 of 2019.pdf","source_url":"\/cms\/images\/LEGISLATION\/SUBORDINATE\/2019\/2019-0017\/2019-0017_SL 17 of 2019.pdf","storage_path":"\/Users\/q\/kyleg-data\/pristine\/SUBORDINATE\/2019\/2019-0017\/2019-0017_SL 17 of 2019.pdf","content_md5":"9f243d2c635dd5d2c4fb2b9c0063df2f","byte_size":"229685","http_last_modified":null,"fetched_at":"2026-06-21 23:09:34.801375+00"},{"file_id":"926","expr_id":"463","kind":"working_pdf","filename":"2019-0017_SL 17 of 2019.pdf","source_url":"\/cms\/images\/LEGISLATION\/SUBORDINATE\/2019\/2019-0017\/2019-0017_SL 17 of 2019.pdf","storage_path":"\/Users\/q\/kyleg-data\/working\/SUBORDINATE\/2019\/2019-0017\/2019-0017_SL 17 of 2019.pdf","content_md5":"9f243d2c635dd5d2c4fb2b9c0063df2f","byte_size":"229685","http_last_modified":null,"fetched_at":"2026-06-21 23:09:34.801375+00"}],"paragraph_count":2,"latest_history":null},"quality":{"expr_id":"463","doc_id":"463","quality_state":"needs_review","quality_score":"85","needs_human_review":"t","deterministic_categories":"{page_header_footer_noise}","llm_categories":"{truncated_text,other}","repair_actions":"{collapse_duplicate_text,manual_review,reextract_full_text,strip_page_furniture}","finding_severity_counts":"{\"low\": 1, \"medium\": 1}","finding_summary":"Sample appears mostly clean but shows truncation at Regulation\u202f8 and lingering page\u2011break markers; human review recommended to confirm completeness.","assessed_at":"2026-06-22 15:29:45.543247+00","updated_at":"2026-06-22 15:29:45.543247+00"}}