Data Protection Monitor · Side-by-Side Matrix
Compare Jurisdictions Across All 10 Standing Modules
Select up to 3 jurisdictions on Explore (Free) or up to 6 jurisdictions on Single-Site Pro or All-Access Pro to compare regulatory posture, module RAG status, cited evidence counts, and supervisory authorities side by side.
Preset Comparisons:
| Standing Module | Gibraltar (GI) Expert reviewed Gibraltar Regulatory Authority (GRA) — Information Rights Division | United Kingdom (UK) Expert reviewed Information Commissioner's Office (ICO) | France (FR) Commission Nationale de l'Informatique et des Libertés (CNIL) |
|---|---|---|---|
| D1 Regulator & Framework | Green · Confirmed 6 cited spans Gibraltar's data protection regime is governed by the Data Protection Act 2004 (DPA 2004, Act No. 2004-01, substantially restructured on 25 May 2018 and amended at post-Brexit transition on 1 January 2021 by the Data… Inspect GI D1 → | Green · Confirmed 10 cited spans The United Kingdom operates a mature, comprehensive data protection framework anchored in the retained UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Elec… Inspect UK D1 → | Green · Confirmed 0 cited spans France applies the GDPR directly alongside the national Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés), as substantially rewritten by the Law of 20 June 2018, Ordonnance n° 2018-1125 and Décret n° 2019-… Inspect FR D1 → |
| D2 Lawful Processing & Special Data | Amber · Conditional 4 cited spans Processing of personal data in Gibraltar requires one of the six lawful bases in Art. 6(1)(a)–(f) Gibraltar GDPR (consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests su… Inspect GI D2 → | Amber · Conditional 4 cited spans Processing under Art. 6(1) UK GDPR requires one of the traditional six lawful bases or — from 5 February 2026 under DUAA 2025 s.70 (commenced by SI 2026/82) — the new Art. 6(1)(ea) 'recognised legitimate interests' ba… Inspect UK D2 → | Green · Confirmed 0 cited spans GDPR Article 6 lawful bases apply directly; consent for trackers must be a clear positive act under Article 82 LIL. Health and other special-category data receive enhanced national safeguards (Article 66 LIL), and CNI… Inspect FR D2 → |
| D3 Data Subject Rights | Amber · Conditional 3 cited spans Chapter III (Arts. 12–23) of the Gibraltar GDPR confers the full suite of data subject rights: transparent privacy notices (Arts. 13–14), subject access (Art. 15 DSAR), rectification (Art. 16), erasure / right to be f… Inspect GI D3 → | Green · Confirmed 4 cited spans Chapter III UK GDPR provides rights to be informed (Arts. 13–14, with DUAA s.77 broadening the Art. 14 disproportionate-effort exemption for research from 5 February 2026), access (Art. 15), rectification (Art. 16), e… Inspect UK D3 → | Amber · Conditional 0 cited spans GDPR Articles 15-22 rights apply fully, including to processing nominally exempt from consent (e.g., audience measurement). CNIL has reinforced minors' erasure rights and equal-ease-of-refusal standards for trackers.… Inspect FR D3 → |
| D4 Controller & Processor Duties | Amber · Conditional 6 cited spans Chapter IV (Arts. 24–43) of the Gibraltar GDPR imposes identical accountability, governance, and security obligations to the EU and UK GDPR baselines: controllers must implement Data Protection by Design and by Defaul… Inspect GI D4 → | Amber · Conditional 9 cited spans The UK retains the full GDPR Chapter IV accountability architecture (Art. 5(2) and Art. 24 UK GDPR): controllers must implement Privacy by Design and by Default (Art. 25), maintain Records of Processing Activities (Ar… Inspect UK D4 → | Green · Confirmed 0 cited spans CNIL's 2026 enforcement wave (FREE MOBILE/FREE, FRANCE TRAVAIL, IQVIA, NEXPUBLICA) evidences active application of accountability/DPIA, DPO, joint-controller, security, breach-notification and retention obligations un… Inspect FR D4 → |
| D5 Cross-Border & Adequacy | Amber · Conditional 4 cited spans Gibraltar's cross-border transfer profile is asymmetrically structured across the UK and the EEA. First, between the United Kingdom and Gibraltar, personal data flows unrestricted in both directions: the UK grants sta… Inspect GI D5 → | Green · Confirmed 9 cited spans Inbound EEA-to-UK personal data flows continue without supplementary transfer mechanisms following the European Commission's adoption on 19 December 2025 of Implementing Decision (EU) 2025/2545 (under Art. 45 GDPR) an… Inspect UK D5 → | Red · Restricted 0 cited spans France applies the GDPR's uniform EU transfer regime (adequacy decisions, SCCs, BCRs, derogations) as an EU Member State; no FR-specific derogation or localisation mandate beyond the sector-specific CNIL authorisation… Inspect FR D5 → |
| D6 Sectoral Watch | Amber · Conditional 6 cited spans Sectoral data protection governance in Gibraltar is tightly integrated with its primary regulated industries: financial services, distributed ledger technology (DLT), remote gambling, electronic communications, health… Inspect GI D6 → | Amber · Conditional 5 cited spans Sectoral overlays reinforce the horizontal UK GDPR/DPA 2018 baseline across financial services, health, telecommunications, employment, credit reporting, education, and insurance. In financial services, the FCA andICO… Inspect UK D6 → | Amber · Conditional 0 cited spans Financial (banks/insurers), telecoms/ePrivacy and employment/public-sector data processing carry distinct overlays evidenced by CNIL DPO guidance and 2026 enforcement (FRANCE TRAVAIL). Credit-scoring and education-sec… Inspect FR D6 → |
| D7 AdTech & Commercial Privacy | Amber · Conditional 2 cited spans Electronic marketing, cookies, and online tracking in Gibraltar are governed by the Communications (Personal Data and Privacy) Regulations 2006 (CPDPR 2006, LN 2006/126) read alongside the Gibraltar GDPR. Under Reg. 6… Inspect GI D7 → | Amber · Conditional 4 cited spans PECR Reg. 6 requires prior UK GDPR-standard consent for non-essential cookies, pixels, SDKs, and browser fingerprinting unless an exemption applies. From 5 February 2026, DUAA 2025 s.112 and Schedule 12 (commenced by… Inspect UK D7 → | Amber · Conditional 0 cited spans CNIL's cookie/tracker regime (2020 guidelines and recommendation, consolidated January 2026, plus 2026 multi-device recommendations) is the dominant adtech-privacy instrument, alongside enforcement distinguishing GDPR… Inspect FR D7 → |
| D8 Algorithmic, Biometric & AI | Red · Restricted 2 cited spans Gibraltar retains the unamended Art. 22 Gibraltar GDPR prohibition on solely automated decision-making, including profiling, that produces legal effects concerning a data subject or similarly significantly affects the… Inspect GI D8 → | Amber · Conditional 7 cited spans From 5 February 2026, DUAA 2025 s.80 (commenced by SI 2026/82) replaces the former Art. 22 UK GDPR general prohibition on solely automated decision-making (ADM) with new Articles 22A–22D UK GDPR. Under Art. 22B, solel… Inspect UK D8 → | Amber · Conditional 0 cited spans CNIL actively enforces the Article 9 GDPR biometric special-category regime (sanctioning scraped facial-recognition databases) and is shaping the France/EU interface between GDPR and the EU AI Act, including risk-tier… Inspect FR D8 → |
| D9 Children & Vulnerable Groups | Red · Restricted 2 cited spans Under Art. 8(1) Gibraltar GDPR and s.14 of the Data Protection Act 2004, the digital age of consent for the direct offer of Information Society Services (ISS) to a child in Gibraltar is 13 years. Where a child is unde… Inspect GI D9 → | Amber · Conditional 5 cited spans The UK sets the digital age of consent for Information Society Services (ISS) at 13 under Art. 8 UK GDPR and s.9 DPA 2018 (where a child is under 13 and the controller relies on consent, parental responsibility holder… Inspect UK D9 → | Amber · Conditional 0 cited spans France sets the digital age of consent at 15 (Article 45 LIL), requiring joint minor-plus-parent consent below that age. The SREN law and Arcom age-verification référentiel (subject to CNIL opinion) address pornograph… Inspect FR D9 → |
| D10 Enforcement & Redress | Amber · Conditional 3 cited spans Part VI (ss.135–183) of the Data Protection Act 2004 and Art. 83 Gibraltar GDPR vest the GRA (as Information Commissioner) with comprehensive investigative, corrective, and fining powers: Information Notices (s.136),… Inspect GI D10 → | Green · Confirmed 11 cited spans Under Art. 83 UK GDPR and s.157 DPA 2018, maximum administrative fines are £8.7 million or 2% of total worldwide annual turnover (standard tier) and £17.5 million or 4% of total worldwide annual turnover (higher tier)… Inspect UK D10 → | Green · Confirmed 0 cited spans CNIL enforcement is highly active: 2025 fines totalled €486,839,500 and 2026 has already seen €27m/€15m (Free Mobile/Free), €5m (FRANCE TRAVAIL), €5m (IQVIA) and €1.7m (NEXPUBLICA) sanctions, backed by daily-penalty i… Inspect FR D10 → |