What Is Information, Communications and Media Act of Bhutan 2018, Chapters 17 and 21 + National Data Governance Framework 2025 (No Enacted Standalone Data Protection Act)?
No enacted "Data Protection Act of Bhutan 2025" or later standalone omnibus privacy statute was located in the reviewed official Bhutan sources. The 2025 National Data Governance Framework was approved for implementation and took effect on 11 July 2025, but it expressly refers to the absence of national regulations for data privacy and protection and assigns development of future privacy regulations to government bodies. It is therefore an official governance framework, not a Data Protection Act. The operative privacy provisions located are principally Chapter 17, concerning protection of online or offline privacy, and Chapter 21, concerning data protection, of the Information, Communications and Media Act of Bhutan 2018. The Act came into force on 8 January 2018, applies throughout Bhutan, and covers ICT and media sectors and their providers and users. No later amendment or repeal instrument was located in the reviewed official listings. The result is a fragmented, sectoral framework rather than a GDPR-style standalone rights statute. The Act provides consent, notice, review, amendment, removal, confidentiality, security, child-data, direct-marketing, and obsolete-data protections, but no express standalone portability, restriction, objection, or solely automated-decision rights were located. No Bhutan-specific data-broker or public-record deletion route was located.
At a glance
- Full name
- Information, Communications and Media Act of Bhutan 2018, Chapters 17 and 21 + National Data Governance Framework 2025 (No Enacted Standalone Data Protection Act)
- Short code
- ICM Act 2018 + NDGF 2025
- Jurisdiction
- Bhutan
- Enacted
- 2018
- Last major update
- National Data Governance Framework approved for implementation and effective 11 July 2025; no later amendment or repeal instrument was located in the reviewed official listings
- Regulator
- Bhutan InfoComm and Media Authority (BICMA)
- Private right of action
- Limited
Scope, who ICM Act 2018 + NDGF 2025 covers
Protected data
Data subject rights
Right to give or withhold written permission or consent before personal information is collected, collated, or processed unless collection is permitted or required by law
Right to require legal authorization or specific written authorization before disclosure to a third party
Right to an accessible privacy policy describing data types and sources, purposes, uses, recipients, and available choices
Right to be told how to review, amend, or remove personal information
Right to request removal or withdrawal of personal information
Right to protection when personal or sensitive information is transferred to third parties
Right to confidentiality, integrity, and security protections
Right to unsubscribe from unsolicited commercial email through a simple opt-out procedure
Right to deletion or destruction of obsolete personal information
Right to express and verifiable parental or guardian consent protections for children’s personal information
Notable features
The 2025 National Data Governance Framework establishes principles of minimization, purpose limitation, deletion when data is no longer necessary or lawful, authorized access, informed consent, pseudonymization or anonymization, and limited crisis or emergency processing without consent. These are framework requirements rather than a separately enacted data-subject-rights statute.
Enforcement & penalties
Regulator: Bhutan InfoComm and Media Authority (BICMA)
Penalties: The ICM Act provides compensation determined by the Court for negligent failure to implement reasonable security controls causing wrongful loss or gain, intentional or knowing unlawful disclosure, unauthorized downloading, copying, or extraction of personal information, and breach of confidentiality or privacy. The Act provisions reviewed do not state a fixed ngultrum fine. Under the official Penal Code classification, a misdemeanour carries imprisonment of at least one year and less than three years, subject to applicable sentencing rules. The ICT/media Consumer Protection Code separately provides sectoral penalties: first violation, a written warning or up to six months’ daily minimum wage, or both; subsequent violation, up to one year’s daily minimum wage, with doubling for succeeding violations.
Private right of action: The ICM Act provides Court-determined compensation for specified privacy, disclosure, extraction, and security offenses, and an aggrieved party may appeal an Authority decision to the Alternative Dispute Resolution Centre within 10 working days. No separate general private civil-action route for all data-protection disputes was located.
Relevance to data brokers
No Bhutan-specific data-broker registration, complaint, deletion, suppression, or opt-out route was located. No public-record-specific privacy complaint, deletion, suppression, or takedown route was located. The Department of Civil Registration and Census provides update and correction mechanisms for individual civil records, but the reviewed forms concern correcting or updating records rather than general privacy deletion or public-record suppression.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does Bhutan have a standalone Data Protection Act?+
No enacted standalone Data Protection Act was located in the reviewed official sources. The 2025 National Data Governance Framework expressly refers to the absence of national regulations for data privacy and protection. Current privacy provisions are principally found in Chapters 17 and 21 of the Information, Communications and Media Act 2018.
What privacy protections currently exist in Bhutan?+
The ICM Act generally requires consent for collection and processing, authorization for disclosure, accessible privacy policies, review, amendment and removal choices, intended-purpose use, security and confidentiality safeguards, child-data consent, direct-marketing opt-outs, and deletion or destruction of obsolete information.
Can I ask a Bhutanese data broker to delete my information?+
No Bhutan-specific data-broker registration, complaint, deletion, suppression, or opt-out route was located, and no public-record-specific privacy deletion or takedown route was located.
Official sources & citations
Other international privacy regimes
ICM Act 2018 + NDGF 2025 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: