AG Data Protection & Privacy Regulation

The practical significance for surveillance-governance readers is that the compelled-production power now reported in force operates on a track separate from, and additional to, whatever national-security or law-enforcement carve-out already exists within the Data Protection Act. Exact Act number and commencement date for the Electronic Crimes (Amendment) Act were not located, so the instrument is reported here from wire-service coverage of its parliamentary passage rather than from the statute's own text.

Other Developments

No other module carries material content; the regime's regulator and framework structure, data subject rights, controller and processor duties, cross-border transfer position and enforcement architecture all remain as previously established and are not revisited here.

Cross-Monitor Connections

The compelled-production powers reported under the Electronic Crimes (Amendment) Act touch on territory that financial-crime monitoring also tracks from an investigatory-powers angle, though no specific cross-reference was identified in the material reviewed beyond the general observation that criminal-investigation data-access powers and financial-integrity enforcement tooling often intersect.

Outlook

The principal gap to close is confirmation of the Electronic Crimes (Amendment) Act's own text, exact commencement date, and its precise relationship, if any, to the Data Protection Act's existing exemptions. Until that primary text is retrieved, the surveillance-governance picture for Antigua and Barbuda rests on secondary reporting of the Act's passage rather than on the instrument itself.

Standing brief · as of 11 October 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Antigua and Barbuda's core data-protection framework, the Data Protection Act, 2013, has not itself been amended this cycle, but a new sectoral cross-reference in payments legislation is extending its reach into a specific financial-services context. The Payment Systems and Services Act, 2025, requires a licensee or participant to process personal data through a system that facilitates the prevention, detection and investigation of payment fraud, and requires that personal data be processed in accordance with the Data Protection Act, 2013 and any law governing data protection. This provision is enacted but not yet effective, since the Act as a whole commences only on a date to be appointed by the Minister by Notice published in the Gazette, which has not yet been published.

Separately, an earlier Bill-stage development has an uncertain status. The Banking (Amendment) Bill 2025, in draft, proposed that a licensed financial institution shall alert the Central Bank and the affected financial consumers within twenty-four hours of any security breaches. Whether this specific clause survived into the enacted Banking (Amendment) Act 2025 was not confirmed from the enacted-Act excerpt retrieved this cycle, so this remains an open question rather than a settled finding.

Other Developments

The Payment Systems and Services Act 2025 ties payment-fraud-prevention data processing explicitly to the 2013 Act. This is a confirmed, directly sourced development: the provision is in the enacted statute's own text. Its significance lies less in creating a new data-protection obligation from scratch and more in explicitly binding a financial-sector data-processing duty to the pre-existing general data-protection law, reinforcing applicability of the 2013 Act in a sector where compliance might otherwise have been treated as a matter purely of financial regulation.

The fate of the Banking Bill's proposed 24-hour breach-notification duty remains unconfirmed. Because the enacted Act excerpt retrieved this cycle did not settle whether the draft Bill's specific breach-alert clause was carried through to the final Act, this cannot currently be treated as either a confirmed obligation or a confirmed omission; it is reported here as a genuine open question pending further primary-source review of the Act's final enacted text.

Cross-Monitor Connections

The Payment Systems and Services Act 2025's cross-reference to the Data Protection Act 2013 connects directly to the world-payments monitor's tracking of the same Act's licensing and conduct provisions, and to the financial-integrity monitor's tracking of the Banking (Amendment) Act 2025's market-conduct-supervision powers; all three monitors are observing different facets of the same cluster of 2025 financial-sector legislation.

Outlook

Two items warrant tracking. First, the Payment Systems and Services Act 2025's commencement, via Ministerial Gazette notice, will determine when the fraud-prevention data-processing duty linked to the 2013 Act actually takes legal effect; until then it remains enacted but not yet effective. Second, confirmation of whether the enacted Banking (Amendment) Act 2025 retains the draft Bill's 24-hour security-breach alert duty would resolve a currently open question about the jurisdiction's breach-notification landscape for licensed financial institutions.