Data protection & privacy laws in Maldives (2026)

The Maldives' prior regime was the limited Data Protection Act 2017 (effective January 2018), which set basic principles for collection, use, and disclosure of personal data but lacked comprehensive individual rights and an independent enforcement body.

A comprehensive Personal Data Protection Act was developed following a public consultation on a draft bill released 17 May 2023. Government targeted enactment by January 2025 with full compliance by January 2026; official Maldivian institutional sources published the enacted Act text by November 2025.

The Act grants data subjects rights to access, rectification, erasure, and objection. Sensitive categories — including health, biometric, religious belief, and political opinion data — carry enhanced protection requirements.

A Data Protection Authority (DPA) is established under the Act, initially housed within the National Centre for Information Technology (NCIT). It holds powers to audit data controllers and processors, investigate complaints, and impose penalties; its placement within the NCIT has raised concerns among commentators about full regulatory independence.

The Act restricts transfers of personal data outside the Maldives, requiring adequate safeguards to be in place before any such transfer may occur, aligning with GDPR-style adequacy/transfer mechanism logic.

The data protection framework was developed in parallel with a Cybersecurity Bill and under the 'Digital Maldives' initiative, supported by the World Bank and UNDP, reflecting a broader national digital governance reform agenda.