A government bill before the People's Majlis since May would give the Maldives its first comprehensive data protection law. The Personal Data Protection Bill, a 104-section text in Dhivehi dated 10 May 2026 and presented on the government's behalf by Ali Ibrahim, the member for West Henveyru, would create a Privacy Commissioner, give data subjects a set of enforceable rights, require breach reports within 72 hours and allow fines of between MVR 250,000 and MVR 10,000,000. The People's Majlis secretariat stamped the bill as received at 13:30 on 10 May 2026 under register number 1333.

In Short

The Maldives government has sent parliament a bill that would, for the first time, set out comprehensive rules for how personal data is collected, used and moved abroad, with a Privacy Commissioner to enforce them. It reaches companies outside the country that sell to people in the Maldives or monitor their behaviour there, so global platforms, ad tech vendors and travel businesses serving Maldivian users are in scope alongside local firms. If passed, the rules would apply six months after the law is ratified and published in the Government Gazette, with consent, children's data, direct marketing, breach reporting and cross-border transfers all regulated.

A regime modelled on familiar lines

The bill runs to 123 pages: a cover sheet, a one-page statement of reasons signed by Ali Ibrahim on 10 May 2026, a five-page table of contents and 116 pages of provisions, each initialled and stamped with the government seal. It is organised in 12 chapters. Anyone who has worked with the European Union's General Data Protection Regulation will recognise most of the architecture: controllers and processors, lawful bases, special categories of data, data protection officers, impact assessments, adequacy decisions, binding corporate rules and a list of aggravating and mitigating factors for fines that tracks the GDPR's almost item by item.

The statement of reasons sets out what the government wants the law to achieve. According to that note, the bill aims to establish a system for collecting, processing and using personal data in the Maldives under a legal framework and to set the responsibilities of those who handle it. The note lists seven objectives: the duties of those who collect, process or use personal data; the legal bases for processing and the rules for special categories; the rules for transferring personal data to foreign countries and international organisations; the rights of data subjects; how controllers and processors must act when a breach occurs; the role and powers of the Privacy Commissioner; and the handling of complaints and enforcement measures.

The Maldives has no single, comprehensive data protection statute. The Maldives Independent reported on 7 May 2026 that a draft had been pending for years. Attorney General Ahmed Usham announced the government's bill at a press conference at the President's Office on 6 May 2026, according to Edition.mv, saying it had been prepared with technical assistance from foreign partners and would reach parliament within days. It reached the Majlis secretariat four days later.

The bill then went to the Majlis Information and Communication Technology Committee, which opened a public consultation on 24 June 2026 with comments due by 8 July, according to MV+. PPC Land found no public record, by 15 November 2026, of a committee report, a final vote or ratification. The Government Gazette's list of laws enacted in 2026 runs from Law No. 1/2026 to Law No. 17/2026, the latest dated 1 September 2026, and none of them is a data protection law.

Who would enforce it

Chapter Three creates the office of Privacy Commissioner. Section 17 does not set up a new body. Instead, according to the bill, the Privacy Commissioner "is the Information Commissioner established under Law No. 1/2014 (Right to Information Act)" (PPC Land translation). The same section requires a dedicated unit within the commissioner's office to carry out the new privacy functions. Section 18 assigns the commissioner the job of monitoring and enforcing the law, including through investigations and inspections, and of raising public awareness of the risks, rules, safeguards and rights connected to processing.

That choice has drawn criticism. An opinion piece published by Corporate Maldives on 15 May 2026 argued that handing the role to the Information Commissioner could weaken enforcement and called for an independent regulator.

The commissioner would also make the regulations. Section 102 states that, unless the law says otherwise, the Privacy Commissioner makes and enforces the regulations required under it, and that those regulations must be made and published within six months of the law taking effect.

Reach beyond the Maldives

Section 3 extends the law to controllers and processors that are not established in the Maldives when they process personal data of data subjects in the country in connection with two activities: offering goods or services to people in the Maldives, whether or not payment is required, and monitoring their behaviour as far as that behaviour takes place in the Maldives. The second limb is the one that matters for advertising. Tracking, profiling and audience building aimed at Maldivian users fall within it, wherever the servers sit.

Section 4 gives the bill precedence. Unless another law expressly provides otherwise, its provisions prevail where data protection rules in other legislation conflict with it. Section 5 commits the text to technological neutrality, so that its obligations apply regardless of the technology used to process data.

The numbers in the bill

Provision Section What the bill sets
Fine range 99 MVR 250,000 to MVR 10,000,000, in addition to the administrative measures in section 97(a)
Fine range in US dollars PPC Land calculation About USD 16,200 to USD 648,500, at roughly 15.42 rufiyaa per dollar
Factors weighed when setting a fine 98 11, from gravity and duration to financial gain
Breach report to the Privacy Commissioner 81 Within 72 hours of the controller or processor becoming aware
Age at which a child can consent to online services 43 15 years
Reply to a data subject request 56 One month from receipt
Extension for complex or numerous requests 56 Two further months
Publication of enforcement list 101 Within 30 days of the commissioner taking action
Commencement 103 Six months after ratification and publication in the Government Gazette
Deadline for regulations 102 Six months after the law takes effect
Lawful bases for processing 41 Nine
Structure - 104 sections, 12 chapters, 116 pages of provisions

Section 41 lists nine grounds on which processing is lawful. They begin with consent given for one or more specific purposes and the performance of a contract with the data subject, and run through compliance with a legal obligation, protecting a person's life, tasks carried out in the public interest or under official authority, a legitimate purpose that is not overridden by the data subject's fundamental rights, and the establishment or defence of legal claims in court.

Consent carries conditions. Under section 42, a controller relying on consent must be able to show that the data subject gave it. A consent request made in a written declaration that also covers other matters has to be clearly separated from them and written in plain language, and the data subject can withdraw consent at any time. When assessing whether consent was freely given, the bill points to whether a contract or service has been made conditional on consent to processing that is not necessary for it, a test that mirrors Article 7(4) of the GDPR.

The age-15 line

Section 43 is the provision most likely to change product design. Where information society services are offered directly to a child, processing that child's personal data is lawful only if, according to the bill (PPC Land translation):

  1. "the child is at least 15 years old and the child has given consent to the processing of the child's personal data"; or
  2. where the child is under 15, consent is given or authorised by the child's parent or guardian, and only to the extent of that authorisation.

The bill defines the services caught by this rule. Section 43(b) states that information society services include "digital platforms, online gaming services, social media services, search engines and content sharing services" (PPC Land translation). Preventive or counselling services offered directly to a child are excluded. Section 43(c) requires controllers relying on parental consent to make reasonable efforts to verify that it was given by the person with parental responsibility, taking into account available technology. Section 43(d) leaves general contract law, including the rules on whether a child can form a valid contract, untouched.

The 15-year threshold sits below the definition of a child elsewhere in Maldivian law. Section 104 defines a child by reference to Law No. 19/2019, the Child Rights Protection Act, which covers people under 18. A 16-year-old could therefore consent alone to a social media platform's processing while still counting as a child under that act.

Direct marketing and profiling

Chapter Eight sets out the rights of data subjects: information, access, rectification, erasure, restriction of processing, notification of those changes to recipients, portability and objection. Section 56 requires controllers to respond to requests within one month of receipt, extendable by two further months where the complexity or number of requests makes that necessary.

Section 64, the right to object, is where the marketing provisions live. A data subject may object at any time, on grounds relating to their particular situation, to processing based on the public-interest or legitimate-purpose grounds, including profiling based on them. The controller must then stop unless it can show compelling legitimate grounds that override the data subject's interests, or the processing is needed for legal claims.

Direct marketing gets an unconditional version of the right. According to section 64(b) (PPC Land translation), "where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data for such marketing, including profiling to the extent that it is related to such direct marketing." Section 64(c) adds that once a data subject objects, "the personal data shall no longer be processed for such purposes."

Two further subsections matter for anyone running campaigns. Section 64(d) requires that the right to object be brought explicitly to the data subject's attention at the latest at the time of the first communication, presented clearly and separately from any other information. Section 64(e) allows a data subject using information society services to exercise the right to object by automated means using technical specifications, wording that mirrors Article 21(5) of the GDPR and could cover browser-level or device-level opt-out signals.

The bill also contains a section on automated processing used to make decisions about individuals (section 48) and treats profiling as a defined term (section 15).

Breaches: a 72-hour clock

Chapter Ten deals with personal data breaches across 11 sections, from detection and containment to records. A processor that becomes aware of a breach must tell the controller. Section 81 then requires notice to the Privacy Commissioner within 72 hours of the controller or processor becoming aware of the breach. Section 82 requires communication to affected data subjects where the breach is likely to result in a high risk to their rights and freedoms, section 83 sets out exceptions, and section 84 prescribes what a breach notice must contain.

The 72-hour figure matches the GDPR's Article 33 deadline. For international companies already running a European breach process, the Maldivian clock would slot into existing procedures. For local businesses without one, it would be new.

Moving data abroad

Chapter Nine governs cross-border transfers and splits into two parts. The first covers general transfers. Under section 65, personal data may leave the Maldives for a foreign country or international organisation only on one of four routes: an adequacy decision by the Privacy Commissioner under section 66, appropriate safeguards under section 67, binding corporate rules approved under section 68, or the derogations for specific situations in section 69. Section 66 asks the commissioner to weigh the rule of law and respect for human rights in the destination, the existence and effective functioning of independent supervisory authorities, and the destination's international commitments.

Section 67 permits transfers without an adequacy decision only where the controller or processor has provided appropriate safeguards and data subjects have enforceable rights and effective legal remedies. Section 70 covers international cooperation on data protection.

The second part, sections 71 to 76, deals with transfers abroad for law enforcement purposes, defined to include the prevention, investigation, detection and prosecution of criminal offences.

For the Maldives, where tourism is the dominant industry and guest data routinely flows to overseas booking engines, property management systems, payment processors and marketing platforms, the transfer chapter could prove the most operationally demanding part of the law. The bill does not list any destination as adequate. That decision would fall to the commissioner after the law takes effect.

Officers, assessments and security

Chapter Five covers the security of personal data. Section 32 requires security measures in processing, section 33 covers data protection impact assessments and section 35 sets out when a data protection officer must be appointed. According to the bill, controllers and processors must designate one where processing is carried out by a public authority, except courts acting in their judicial capacity, where their core activities require regular and systematic monitoring of data subjects on a large scale, or where they process special categories of data or criminal conviction data on a large scale.

Special categories, defined in section 9, include data revealing racial or ethnic origin, political opinions, religious beliefs and membership of associations, as well as health, genetic and biometric data. Processing them is governed by section 46, and processing data on criminal convictions by section 47.

Enforcement and penalties

Chapter Eleven sets out complaints, compensation and administrative measures. Any data subject may complain to the Privacy Commissioner under section 89, and section 95 preserves the right to take a matter to court. Section 96 gives any person who suffers material or non-material damage from a breach of the law a right to compensation from the controller or processor responsible.

Section 97 lists the administrative measures available to the commissioner, from warnings to fines. Section 98 sets out how fines are decided, through 11 factors: the nature, gravity and duration of the infringement, including the number of data subjects affected and the damage they suffered; whether it was intentional or negligent; action taken to mitigate the damage; the degree of responsibility given the technical and organisational measures in place; previous infringements; cooperation with the commissioner; the categories of data affected; how the infringement came to the commissioner's attention, including whether the controller reported it; compliance with earlier orders; adherence to approved codes of conduct or certification; and any other aggravating or mitigating factor, such as financial benefits gained or losses avoided.

Section 99 sets the range. According to the bill (PPC Land translation), where the listed acts are committed, "in addition to the administrative measures set out in section 97(a) of this law, a fine of between 250,000 (two hundred and fifty thousand) rufiyaa and 10,000,000 (ten million) rufiyaa may be imposed." The listed acts include breaching the processing principles in Chapter Six, breaching the obligations of controllers and processors, infringing the data subject rights in Chapter Eight, breaching the conditions for transfers in Chapter Nine, and breaching the breach-notification provisions in Chapter Ten.

Unlike the GDPR, which caps fines at the higher of a fixed sum or a share of worldwide annual turnover, the Maldivian bill uses a flat range. At about USD 648,500, the ceiling is modest for a multinational platform (PPC Land calculation). For a resort group, a domestic bank or a telecoms operator, it is not.

Two further provisions add reputational weight. Section 100 requires the commissioner to refer conduct that also amounts to a criminal offence under another law to the relevant investigating authority. Section 101 requires the commissioner to publish a list of the parties against whom it has taken action, within 30 days of taking that action.

How the law would come into force

The bill sets out a fixed sequence before obligations apply:

  1. The People's Majlis passes the bill, after the committee stage now under way.
  2. The President ratifies it.
  3. The law is published in the Government Gazette.
  4. Six months after ratification and publication, the law takes effect (section 103).
  5. Within six months of the law taking effect, the Privacy Commissioner makes and publishes the regulations required under it (section 102).

On that timetable, businesses would have at least six months between gazetting and the first obligations, and the detailed regulations could arrive up to a year after gazetting.

Why it matters for marketers

The bill arrives as several jurisdictions in Asia and Africa adopt or finalise comparable laws. Vietnam's Decree 356/2025/ND-CP took effect on 1 January 2026, with a 72-hour breach notice, parental consent below 16 and transfer routes that include standard contractual clauses, binding corporate rules and adequacy. Cambodia's draft data protection law sets fines of up to 600 million riels or 10% of turnover, a 72-hour breach notice and parental consent below 16. India published its Digital Personal Data Protection Rules on 13 November 2025, with most provisions applying after 18 months. Egypt's Executive Decree 816 of 2025 made Law 151/2020 operational, with 72-hour breach reports and authorisation requirements for cross-border transfers. Bangladesh's draft ordinance treats anyone under 18 as a child and sets fines of up to 5% of local turnover for foreign firms.

Set against that group, the Maldivian bill stands out in two respects. Its consent age of 15 is lower than the 16 used in Vietnam and Cambodia. And its penalty ceiling is a flat sum rather than a share of turnover, unlike the turnover-based maximums in Cambodia's and Bangladesh's drafts.

The transfer chapter follows the European model closely, and European enforcement shows where such chapters lead. The Irish Data Protection Commission fined TikTok €530 million in May 2025, €485 million of it for unlawful transfers of European users' data to China. On 3 September 2025 the EU General Court dismissed the Latombe challenge to the EU-US Data Privacy Framework, which rests on an adequacy decision. The European Data Protection Board's Opinion 28/2025 on Brazil found the Brazilian law closely aligned with the GDPR while flagging limits linked to commercial secrecy and government access, the kind of assessment the Maldivian commissioner would have to make under section 66.

On children, the bill's verification duty lands in a field where regulators have been setting expectations. The EDPB's Statement 1/2025, adopted on 11 February 2025, set 10 principles for age assurance, including use of the least intrusive method. In the United States, the amended COPPA Rule took effect on 23 June 2025 and requires separate parental consent before the data of children under 13 is shared with third parties such as advertisers.

The direct-marketing objection right and the legitimate-purpose basis would put Maldivian practice on terms that European regulators have spent years testing. An EDPB digest of 62 national decisions found direct marketing accepted as a legitimate interest in principle, while a French case built on data broker lists for calls and text messages failed. France's Conseil d'État upheld the CNIL's €40 million fine against Criteo on 4 March 2026.

The bill also adopts a GDPR figure that Brussels has proposed to relax. A draft of the European Commission's Digital Omnibus package would extend the GDPR breach notification window from 72 to 96 hours.

What the document does not say

The bill does not record its own progress beyond submission, and PPC Land found no public record of the committee's findings or of any amendments by 15 November 2026. The text sets no turnover-based penalty, names no destination as adequate and contains no transitional relief for processing that began before commencement. It leaves the content of the implementing regulations to the commissioner. This article is based on the text as submitted on 10 May 2026, so any changes made in committee are not reflected.

Key facts

  • Document: Personal Data Protection Bill (Dhivehi: ޝަޚްޞީ މަޢުލޫމާތު ހިމާޔަތްކުރުމުގެ ބިލު), a government bill to the People's Majlis
  • Presented by: Ali Ibrahim, member for West Henveyru, on behalf of the government
  • Date on the bill: 10 May 2026; statement of reasons signed the same day
  • Majlis receipt: stamped by the People's Majlis secretariat on 10 May 2026 at 13:30, register number 1333
  • Announced by: Attorney General Ahmed Usham, 6 May 2026, according to Edition.mv
  • Status: ICT Committee public consultation from 24 June to 8 July 2026, according to MV+; no later stage found by 15 November 2026, and no data protection law among the 17 laws in the Government Gazette for 2026
  • Length and structure: 123 pages including cover, statement of reasons and contents; 104 sections in 12 chapters
  • Regulator: Privacy Commissioner, a role given to the Information Commissioner under Law No. 1/2014 (Right to Information Act) (section 17)
  • Fines: MVR 250,000 to MVR 10,000,000 (section 99)
  • Breach notice: 72 hours to the Privacy Commissioner (section 81)
  • Children: age-15 consent threshold for information society services (section 43); child defined by Law No. 19/2019 (section 104)
  • Direct marketing: unconditional right to object, including related profiling (section 64)
  • Commencement: six months after ratification and publication in the Government Gazette (section 103)
  • Language: Dhivehi; quotations in this article are PPC Land translations

Timeline

Summary

Who: The government of the Maldives, through a bill presented by West Henveyru MP Ali Ibrahim and announced by Attorney General Ahmed Usham, with the Information Commissioner designated as Privacy Commissioner.

What: A 104-section Personal Data Protection Bill that sets lawful bases, consent and children's rules, direct-marketing objection rights, a 72-hour breach notice, cross-border transfer routes and fines of MVR 250,000 to MVR 10,000,000.

When: The bill is dated 10 May 2026 and was received by the Majlis secretariat that day. The ICT Committee consulted the public from 24 June to 8 July 2026. If enacted, it takes effect six months after ratification and gazetting.

Where: The Maldives, with reach to controllers and processors abroad that offer goods or services to people in the Maldives or monitor their behaviour there.

Why: According to the bill's statement of reasons, to establish a legal framework for collecting, processing and using personal data and to define the duties of those who handle it. For marketers, it would add a GDPR-style compliance regime, including limits on profiling and direct marketing, in a market where none existed.