Data protection & privacy law in Marshall Islands (2026)
Data protection in Marshall Islands: sectoral rules.
The Marshall Islands has historically had no comprehensive data protection statute, relying instead on constitutional privacy guarantees and a few criminal provisions. In 2025 it enacted the Personal Data Protection Act 2025 (P.L. 2025-43), but that law applies only to core Government ministries and agencies, not the private sector, and takes effect twelve months after certification, so its coverage is sector-limited (public sector) rather than a GDPR-style comprehensive regime.
Legal framework
Personal Data Protection Act 2025 (P.L. 2025-43), enacted by the Nitijela (RMI Parliament); applies only to core Government ministries and agencies and is administered by a designated 'competent authority'. No comprehensive private-sector data protection law exists.
Key points: data & privacy in Marshall Islands
Enacted law, public-sector scope only
The Personal Data Protection Act 2025 applies to 'core Government ministries and agencies that may collect, use, store, process, disclose or transfer personal data of natural persons.' It does not establish general obligations for private-sector data controllers, leaving commercial data handling outside a comprehensive regime.
Not yet fully in force
The Act takes effect twelve (12) months after the date of certification, so as of mid-2026 the operative obligations and enforcement machinery were only beginning to apply.
Supervisory 'competent authority'
The Act designates a 'competent authority' with duties and enforcement powers and the ability to make regulations under the Administrative Procedure Act 1979; its officers and engaged persons must keep personal data confidential. Previously the RMI had no dedicated data-protection authority.
Principles, complaints and private right of action
The Act sets out personal-data-protection principles binding on core Government, and includes provisions for complaints, remedies, compliance, and a private right of action for affected individuals.
Constitutional and criminal backdrop
Article II of the RMI Constitution guarantees personal autonomy and privacy, and the Criminal Code criminalizes unlawful eavesdropping, surveillance and breach of privacy of messages, partial protections that pre-date and sit alongside the 2025 Act.
Part of a broader digital-government reform
The data-protection law accompanies the Digital Transformation and Identity Verification Act 2025 and a planned digital-ID rollout; further instruments (a digital transactions bill, cybersecurity programme and harmful digital communications law) are targeted by around August 2028, signalling the framework is still developing.
Sources
Next for Marshall Islands: Digital Payments & FintechPartial
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 25 May 2026. Methodology & how to cite · State of Technology Regulation 2026