Section 7
Responsibilities of organisation
of Personal Data Protection Order, 2025
( 1) In meeting its responsibilities under this Order, an organisation -
{a) shall consider what a reasonable person would consider appropriate in the circumstances including, without limitation, -
(i)
the nature, scope and context of, and purposes for, the organisation's collection, use or disclosure of personal data;
and
(ii)
the nature, type and amount of personal data which may be collected, used or disclosed by the organisation;
{b) is responsible for personal data in its possession or under its control;
16
(c}
shall designate one or more individuals to be responsible for ensuring that the organisation complies with this Order;
(d} shall make available to the public the business contact information of at least one of the individuals designated under paragraph (c);
(e}
shall -
(i)
develop and implement policies and practices that are necessary for the organisation to meet the obligations of the organisation under this Order;
(ii)
develop a process to receive and respond to complaints that may arise with respect to the application of this Order;
(iii)
communicate to its staff information about the organisation's policies and practices referred to in sub-paragraph (i); and
(iv)
make information available on request about -
(A)
the policies and practices referred to in sub-paragraph (i);
(B)
the complaint process referred to in sub-paragraph (ii).
(2)
Without limiting subsection (l)(d}, an organisation is deemed to have satisfied subsection (l)(d} if the organisation makes available the business contact information of any individual mentioned in subsection (l)(c} in any prescribed manner.
(3)
The designation of an individual by an organisation under subsection
(l)
(c} does not relieve the organisation of any of its obligations under this Order.