Company: KMRK
Filing Date: 2025-08-15
Form Type: 20-F
Source: 0001213900-25-077494
Chunk: 73

Company: K-TECH SOLUTIONS CO LTD
Filing Date: 2025-08-15
Form: 20-F
Item: Item 4
Chunk 73
---
2021. The DPA establishes a framework of rights and duties designed
to safeguard individuals’ personal data, balanced against the need of public authorities, businesses and organizations to collect
and use personal data for lawful purposes. The BVI DPA is centered around seven data protection principles (the General Principle, the
Notice and Choice Principle, the Disclosure Principle, the Security Principle, the Retention Principle, the Data Integrity Principle
and the Access Principle) which require among other things that:

  personal data must not be processed without consent unless specific conditions are met and must not be transferred outside the BVI, unless there is proof of adequate data protection safeguards ...  

  where consent has been given to processing of personal data, the data subject may at any time withdraw his or her consent;  
 ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

  a data controller must inform a data subject of specific matters, for instance the purposes for which it is being collected and further processed;  

  personal data must not be disclosed for any purpose other than the purpose for which it was to be disclosed at the time of collection or a purpose directly related thereto or to any party other...  

  a data controller shall, when processing personal data, take practical steps to protect personal data from loss, misuse, modification, unauthorized or accidental access or disclosure, alteratio...  

  personal data must not be kept for longer than is necessary for the purpose;  

  personal data must be accurate, complete, not misleading and kept up to date; and  

  a data subject must be given access to his or her own personal data and be able to correct that data where it is inaccurate, incomplete, misleading or not up to date, except where a request for...  

The BVI DPA imposes specific
obligations on data controllers, including the duty to (i) apply the data protection principles; and (ii) respond in a timely fashion
to requests from data subjects in relation to their personal data.

The Information Commissioner
is the regulator responsible for the proper functioning and enforcement of the BVI DPA. Offences under the BVI DPA include:

  processing sensitive personal data in contravention of the BVI DPA;  

  willfully obstructing the Information Commissioner or an authorized officer in the conduct of his or her duties and functions;  

  willfully disclosing personal information in contravention of the BVI DPA; and  

  collecting, storing or disposing of personal information