The PDP Law Is Fully in Force: Five Obligations for Startups
The PDP Law transition period is over. Here is a compliance checklist for startups.
Law No. 27 of 2022 on Personal Data Protection (the PDP Law) provided a two-year transition period that ended in October 2024. Every data controller, startups included, must now comply.
A lawful basis for processing — such as explicit consent or performance of a contract.
A clear privacy notice on purposes, data types and retention periods.
Honouring data-subject rights, including access, correction and erasure.
Breach notification to data subjects and the authority within 3 x 24 hours.
Impact assessments for high-risk processing, and a data protection officer where required.
Breaches can lead to administrative sanctions, including fines of up to 2% of annual revenue.
General information, not legal advice.
Need an advocate for technology & data protection?
Find verified law firms and advocates who handle this practice area.