--- title: "AG Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/ag-data-protection-privacy-regulation/ source_html: /jurisdictions/antigua-and-barbuda/index.html description: "AG data protection and privacy regulation: 10 categories, 18 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 3759d713fce0579a2f135e097a51f15dda66e2938a9a2e7d70b564137d9858b1 generator: "fe-fleet/md-twin@1.0" --- # AG Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed in transition overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/antigua-and-barbuda/), [Crypto](https://cryptoassets.gi/jurisdictions/antigua-and-barbuda/) Last updated 2026-10-25 · 10 categories · 18 claims · 10 sources in the cumulative register Download report (PDF) Expand all Antigua and Barbuda's core data-protection framework, the Data Protection Act, 2013, has not itself been amended this cycle, but a new sectoral cross-reference in payments legislation is extending its reach into a specific financial-services context. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress. Not fully checked this cycle: Regulator & Framework (4 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ANTIGUA-AND-BARBUDA)[Build Report](/reports/?j=ANTIGUA-AND-BARBUDA)[Compare](/compare/?j=ANTIGUA-AND-BARBUDA) Framework posture In transition 8 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority The Information Commissioner Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 8 / 10 modules assessed 0 Confirmed · 7 Probable · 1 Uncertain · 2 Not yet assessed 10 Categories 6 Red categories 58 Sub-modules 18 Claims 0 Tier-1 sources Traffic-light mix 2 amber 6 red 2 n/a (sums to 10 rendered categories; click to filter) 6 categories flagged red ## Jurisdiction lead brief ###### Latest update · 25 October 2026 #### Lead Signal Antigua and Barbuda's one dated development sits outside the core data-protection statute entirely. The Electronic Crimes (Amendment) Act, reported by regional wire service coverage on 18 June 2026, strengthens law enforcement's power to compel production of electronic information and records from service providers for criminal investigations, with penalties reported as high as one million Eastern Caribbean dollars and up to seven years' imprisonment on indictment for non-compliance, and liability reported to extend to locally-present managers of companies whose supervisors are based overseas. This is understood to be a criminal-procedure instrument, and nothing in the material reviewed shows it amending the Data Protection Act, 2013's own national-security exemption or otherwise altering the omnibus data-protection framework directly; the two instruments appear to sit side by side rather than one modifying the other, though that relationship has not been independently confirmed against primary legislative text. The practical significance for surveillance-governance readers is that the compelled-production power now reported in force operates on a track separate from, and additional to, whatever national-security or law-enforcement carve-out already exists within the Data Protection Act. Exact Act number and commencement date for the Electronic Crimes (Amendment) Act were not located, so the instrument is reported here from wire-service coverage of its parliamentary passage rather than from the statute's own text. #### Other Developments No other module carries material content; the regime's regulator and framework structure, data subject rights, controller and processor duties, cross-border transfer position and enforcement architecture all remain as previously established and are not revisited here. #### Cross-Monitor Connections The compelled-production powers reported under the Electronic Crimes (Amendment) Act touch on territory that financial-crime monitoring also tracks from an investigatory-powers angle, though no specific cross-reference was identified in the material reviewed beyond the general observation that criminal-investigation data-access powers and financial-integrity enforcement tooling often intersect. #### Outlook The principal gap to close is confirmation of the Electronic Crimes (Amendment) Act's own text, exact commencement date, and its precise relationship, if any, to the Data Protection Act's existing exemptions. Until that primary text is retrieved, the surveillance-governance picture for Antigua and Barbuda rests on secondary reporting of the Act's passage rather than on the instrument itself. ###### Standing brief · as of 11 October 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Antigua and Barbuda's core data-protection framework, the Data Protection Act, 2013, has not itself been amended this cycle, but a new sectoral cross-reference in payments legislation is extending its reach into a specific financial-services context. The Payment Systems and Services Act, 2025, requires a licensee or participant to process personal data through a system that facilitates the prevention, detection and investigation of payment fraud, and requires that personal data be processed in accordance with the Data Protection Act, 2013 and any law governing data protection. This provision is enacted but not yet effective, since the Act as a whole commences only on a date to be appointed by the Minister by Notice published in the Gazette, which has not yet been published. Separately, an earlier Bill-stage development has an uncertain status. The Banking (Amendment) Bill 2025, in draft, proposed that a licensed financial institution shall alert the Central Bank and the affected financial consumers within twenty-four hours of any security breaches. Whether this specific clause survived into the enacted Banking (Amendment) Act 2025 was not confirmed from the enacted-Act excerpt retrieved this cycle, so this remains an open question rather than a settled finding. #### Other Developments The Payment Systems and Services Act 2025 ties payment-fraud-prevention data processing explicitly to the 2013 Act. This is a confirmed, directly sourced development: the provision is in the enacted statute's own text. Its significance lies less in creating a new data-protection obligation from scratch and more in explicitly binding a financial-sector data-processing duty to the pre-existing general data-protection law, reinforcing applicability of the 2013 Act in a sector where compliance might otherwise have been treated as a matter purely of financial regulation. The fate of the Banking Bill's proposed 24-hour breach-notification duty remains unconfirmed. Because the enacted Act excerpt retrieved this cycle did not settle whether the draft Bill's specific breach-alert clause was carried through to the final Act, this cannot currently be treated as either a confirmed obligation or a confirmed omission; it is reported here as a genuine open question pending further primary-source review of the Act's final enacted text. #### Cross-Monitor Connections The Payment Systems and Services Act 2025's cross-reference to the Data Protection Act 2013 connects directly to the world-payments monitor's tracking of the same Act's licensing and conduct provisions, and to the financial-integrity monitor's tracking of the Banking (Amendment) Act 2025's market-conduct-supervision powers; all three monitors are observing different facets of the same cluster of 2025 financial-sector legislation. #### Outlook Two items warrant tracking. First, the Payment Systems and Services Act 2025's commencement, via Ministerial Gazette notice, will determine when the fraud-prevention data-processing duty linked to the 2013 Act actually takes legal effect; until then it remains enacted but not yet effective. Second, confirmation of whether the enacted Banking (Amendment) Act 2025 retains the draft Bill's 24-hour security-breach alert duty would resolve a currently open question about the jurisdiction's breach-notification landscape for licensed financial institutions. Read full brief · 874 words Key regulatory facts for AG Regulatory Dimension AG Standing Position Jurisdiction AG (AG) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 18 sourced findings) Regulator & Framework A named regulator and instrument exist in a reputable secondary directory, but primary-instrument verification, scope provisions, and registration mechanics are unconfirmed, so this cannot be rated green. Lawful Processing & Special Data No claim-level evidence located for this JID; heaviest gap-weighted module per prompt priority is unresolved. Data Subject Rights No in-JID evidence located; out-of-JID comparator statutes deliberately excluded per JID discipline. Controller/Processor Duties No claim-level evidence located for this JID across any sub-module. Primary Instruments Cited IAPP, The University of the West Indies, Jamaica Gleaner / CMC, Government of Antigua and Barbuda, AG Official Instrument (laws.gov.ag a2013-10-pdf) Last Confirmed / Updated 2026-10-25 (10 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### AG: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A named regulator and instrument exist in a reputable secondary directory, but primary-instrument verification, scope provisions, and registration mechanics are unconfirmed, so this cannot be rated green. Primary framework Data Protection Act (Law No. 10-13) — cited only via secondary directory; primary gazette/legislation.gov text not located Supervisory authority The Information Commissioner Traffic-light rationale — Amber A named regulator and instrument exist in a reputable secondary directory, but primary-instrument verification, scope provisions, and registration mechanics are unconfirmed, so this cannot be rated green. #### Sub-modules (5) #### Regulator And AuthorityAmber IAPP's directory names the Information Commissioner as the data protection authority for Antigua and Barbuda, but no dedicated data-protection enforcement webpage, statutory-appointment provision, or independence safeguards could be verified. Claims (2): - Antigua and Barbuda's listed Data Protection Authority is 'The Information Commissioner' and its listed privacy legislation is the 'Data Protection Act (Law No. 10-13)', per IAPP's Global Privacy Law and DPA Directory; this secondary-source listing could not be cross-verified against primary gazetted text, a commencement instrument, or an operational DP-specific enforcement record within this research pass. - Information Commissioner (Antigua and Barbuda) — Data Protection Act, 2013 (No. 10 of 2013), with a Data Protection Tribunal to hear appeals #### Act And InstrumentsRed The sole located reference to an Antigua and Barbuda data protection statute is the IAPP directory's label 'Data Protection Act (Law No. 10-13)'. No primary text, official Gazette citation, or confirmed year/number could be independently verified. Claims (1): - Electronic Crimes (Amendment) Act — Failure to comply with a production order for electronic information: fines up to EC$1,000,000 and up to 7 years' imprisonment on indictment; extends liability to locally-present managers of companies whose supervisors are overseas #### Material ScopeRed No source located defining the material scope (what data/processing is caught) of any Antigua and Barbuda data protection instrument. #### Territorial ScopeRed No source located addressing territorial/extraterritorial application (establishment test, targeting/monitoring limbs, representative-appointment duty) for Antigua and Barbuda. #### Regulator Registration And FilingRed No source located confirming a controller registration/notification/fee regime for Antigua and Barbuda analogous to Caribbean peer statutes (e.g., Saint Lucia's or proposed Barbados's controller-registration models). Secondary-source tracking (IAPP's Global Privacy Law and DPA Directory) lists Antigua and Barbuda as having a named data protection authority and a titled statute, but no primary gazette text, commencement order, or regulator enforcement portal for data protection specifically could be located or verified within this research pass. No Tier-1 anchor was supplied in the seed for this JID, and none was independently found. Sources and claims (3) - [IAPP](https://westin.iapp.org/resources/global-privacy-directory/) — Antigua and Barbuda's listed Data Protection Authority is 'The Information Commissioner' and its listed privacy legislation is the 'Data Protection Act (Law No. 10-13)', per IAPP's Global Privacy Law and DPA Directory; this secondary-source listing could not be cross-verified against primary gazetted text, a commencement instrument, or an operational DP-specific enforcement record within this research pass. - [The University of the West Indies](https://www.uwi.edu/data-protection/?q=resources-external-antiguabarbuda) — Information Commissioner (Antigua and Barbuda) — Data Protection Act, 2013 (No. 10 of 2013), with a Data Protection Tribunal to hear appeals - [Jamaica Gleaner / CMC](https://jamaica-gleaner.com/article/world-news/20260618/antigua-toughens-legislation-dealing-cybercrime) — Electronic Crimes (Amendment) Act — Failure to comply with a production order for electronic information: fines up to EC$1,000,000 and up to 7 years' imprisonment on indictment; extends liability to locally-present managers of companies whose supervisors are overseas ### AG: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ No claim-level evidence located for this JID; heaviest gap-weighted module per prompt priority is unresolved. Traffic-light rationale — Red No claim-level evidence located for this JID; heaviest gap-weighted module per prompt priority is unresolved. D2 · Lawful Processing — Full Module Record 4 sub-modules · 50 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### AG: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ No in-JID evidence located; out-of-JID comparator statutes deliberately excluded per JID discipline. Traffic-light rationale — Red No in-JID evidence located; out-of-JID comparator statutes deliberately excluded per JID discipline. #### Sub-modules (5) #### Access RightRed No source located. Claims (1): - Data Protection Act, 2013 — Access, rectification and deletion/erasure of personal data; right to request correction or removal if data is inaccurate or unlawfully processed; statutory response deadline not located #### Rectification And ErasureRed No source located. #### Restriction And ObjectionRed No source located. #### Data PortabilityRed No source located. #### Deadlines And Response WindowsRed No source located. No Antigua-specific source located on access, rectification/erasure, restriction/objection, portability, or statutory response deadlines. Regional comparators located (Barbados draft bill, Saint Lucia Act) are NOT cited here as they are out-of-JID and would misattribute findings. Sources and claims (1) - [The University of the West Indies](https://www.uwi.edu/data-protection/?q=resources-external-antiguabarbuda) — Data Protection Act, 2013 — Access, rectification and deletion/erasure of personal data; right to request correction or removal if data is inaccurate or unlawfully processed; statutory response deadline not located ### AG: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ No claim-level evidence located for this JID across any sub-module. Traffic-light rationale — Red No claim-level evidence located for this JID across any sub-module. D4 · Controller & Processor — Full Module Record 7 sub-modules · 28 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### AG: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Priority module per prompt ordering but zero in-JID evidence located despite targeted searching. Traffic-light rationale — Red Priority module per prompt ordering but zero in-JID evidence located despite targeted searching. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 32 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### AG: D6 Sectoral Watch8 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Concrete sectoral (financial/VASP) regulatory evidence exists, but it is AML/cybersecurity-incident focused rather than data-protection-specific, and no data_access_sharing, health, telecoms, employment, credit, education or insurance overlay evidence was found. Primary framework Digital Assets Business Act 2020 (VASP regulatory framework) — general data-protection sectoral overlays otherwise unverified Supervisory authority Financial Services Regulatory Commission Traffic-light rationale — Amber Concrete sectoral (financial/VASP) regulatory evidence exists, but it is AML/cybersecurity-incident focused rather than data-protection-specific, and no data_access_sharing, health, telecoms, employment, credit, education or insurance overlay evidence was found. D6 · Sectoral Watch — Full Module Record 8 sub-modules · 55 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### AG: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ Priority module per prompt ordering but zero in-JID evidence located. Traffic-light rationale — Not assessed Priority module per prompt ordering but zero in-JID evidence located. #### Sub-modules (6) #### Cookies And TrackersRed No source located. #### Dark PatternsRed No source located. #### Opt Out SignalsRed No source located. #### Clean Rooms And DcrRed No source located. #### Cross Context AdvertisingRed No source located. #### Direct MarketingRed No source located. No source located on cookie/tracker rules, dark-pattern prohibitions, opt-out signals, clean-room rules, cross-context advertising, or direct-marketing consent/suppression rules for Antigua and Barbuda. ### AG: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Priority module per prompt ordering but zero in-JID evidence located. Traffic-light rationale — Red Priority module per prompt ordering but zero in-JID evidence located. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 37 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### AG: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ Zero in-JID evidence located despite targeted searching. Traffic-light rationale — Not assessed Zero in-JID evidence located despite targeted searching. #### Sub-modules (5) #### Age VerificationRed No source located. #### Parental ConsentRed No source located. #### Minor Profiling BansRed No source located. #### Education SettingsRed No source located. #### Dependent AdultsRed No source located. No source located on age of digital consent, parental-consent mechanisms, minor-profiling bans, education-settings rules, or dependent-adult protections for Antigua and Barbuda. ### AG: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Priority module per prompt ordering but zero DP-specific enforcement evidence located; the only adjacent finding is sectoral (AML) and is cross-referenced rather than duplicated here. Traffic-light rationale — Red Priority module per prompt ordering but zero DP-specific enforcement evidence located; the only adjacent finding is sectoral (AML) and is cross-referenced rather than duplicated here. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 52 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (14 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 13-22 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties