--- title: "Curaçao Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/curacao/ source_html: /jurisdictions/curacao/index.html description: "Curaçao data protection and privacy regulation: 10 categories, 24 claims, updated 2026-10-27. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 23b200837805cdf1dfa431010a37f8dd02a34f738a43d1bf8df9ee2a3ac5c760 generator: "fe-fleet/md-twin@1.0" --- # Curaçao Data Protection & Privacy Regulation | Data Protection Monitor No domestic primary official source retrieved yet. None of the sources retrieved for this jurisdiction is the official instrument or regulator publication itself (tier 1). No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Curaçao Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed in transition overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/curacao/), [World Payments](https://payments.gi/jurisdictions/curacao/) Last updated 2026-10-27 · 10 categories · 24 claims · 14 sources in the cumulative register Download report (PDF) Expand all Reports suggest the Curaçao Data Protection Board is not currently operational as the statutory supervisory authority under Ordinance No. Data collected 2026-10-27 · Data published 2026-10-27 AI-assembled from cited sources Not covered: Data Subject Rights, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework (2 open gaps). Evidence re-verified: 2026-10-27 · Position last changed: 2026-10-27 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=CURACAO)[Build Report](/reports/?j=CURACAO)[Compare](/compare/?j=CURACAO) Framework posture In transition 7 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Data Protection Board (Curaçao) — provided for by statute but not yet established Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 7 / 10 modules assessed 0 Confirmed · 7 Probable · 0 Uncertain · 3 Not yet assessed 10 Categories 3 Red categories 57 Sub-modules 24 Claims 0 Tier-1 sources Traffic-light mix 4 amber 3 red 3 n/a (sums to 10 rendered categories; click to filter) 3 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 788 Full executive summary 487 ###### Latest update · 27 October 2026 #### Lead Signal The Curacao Gaming Authority is understood to have discovered unauthorised access to its online licensing portal, with an access window running from December 2025 to September 2026, which exposed confidential beneficial-ownership and licensing data belonging to licensees under the LOK regime. The regulator has permanently discontinued the externally-managed portal, launched a temporary in-house replacement, commissioned an independent forensic investigation into the breach's impact and the system's weaknesses, and filed criminal complaints with authorities in Curacao, Germany and the Netherlands. #### Other Developments No other development is recorded for Curacao this period. #### Cross-Monitor Connections The gambling-sector dimension of this incident — the licensing-portal replacement, the criminal complaints, and the regulatory posture toward the affected licensees — is tracked in the advennt monitor's enforcement and reform-horizon material; this record addresses only the data-exposure and governance angle of the same incident and does not re-analyse the gambling-licensing consequences. #### Outlook The forensic investigation into the breach's impact and into the weaknesses of the discontinued portal has not yet concluded, and no outcome has been published as at 21 October 2026. Whether the Curacao data-protection authority for the National Ordinance on the Protection of Personal Data will separately assess the incident is not yet established; Curacao's absence of an independent supervisory authority for that ordinance is itself a feature of the operating environment rather than a procedural gap in this record. The investigation's outcome, once published, is the signal to watch for any resulting change to how licensing-portal data is secured or handled going forward. 3 earlier updates not shown here. ###### Standing brief · as of 26 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Reports suggest the Curaçao Data Protection Board is not currently operational as the statutory supervisory authority under Ordinance No. 84 of 2010. A challenger review of that baseline finding this cycle flagged it as overstated: contradicting sources report the Board was established in January 2022 and remained at least nominally in place before members reportedly resigned around 2023, leaving seats unfilled. Reports suggest the Board is not currently exercising investigative or enforcement powers under the Data Protection Ordinance. A regulator that was constituted and then lapsed is a materially different picture from one that was never stood up at all, and confidence on both the establishment finding and the enforcement-powers finding has been revised down accordingly, pending verification against a primary government source. #### Other Developments The underlying statute is settled and in force even as the regulator's status is disputed. Ordinance No. 84 of 4 September 2010 is understood to be modeled on the Dutch data-protection implementing act structure. Reports suggest it covers automated and structured-file processing of personal data, per the pre-GDPR EU data protection directive-era structure inherited via the Dutch implementing act. The Ordinance is understood to not set out requirements for data-processing notifications or filings to a supervisory authority. Attributed-only commentary suggests the Ordinance follows the Dutch implementing act's lawful-basis structure, though no Curaçao-specific enumerated lawful-basis text has been independently verified this cycle. The Ordinance is understood to not set out requirements for DPO appointments, and is understood to not set out requirements for data breach notification to a supervisory authority or affected data subjects. On cross-border transfers, the Ordinance is understood to restrict cross-border transfer of personal data to countries not assessed as providing adequate protection, though detail on any further transfer mechanism remains unverified. Separately, reports suggest Curaçao is a member of the Caribbean Financial Action Task Force, viewed by international supervisory bodies as having limited effective AML/tax-enforcement measures, a posture bearing on financial-sector data-sharing and due-diligence practices. #### Cross-Monitor Connections Curaçao's CFATF membership and the reported limited AML/tax-enforcement capacity are flagged for the financial-integrity monitor to assess financial-sector data-sharing and customer due-diligence implications, rather than analysed in depth here. A more speculative routing note also flags a possible payments-specific dimension tied to Curaçao's financial and gaming-licensing sector for the world-payments monitor, as a preliminary flag rather than a confirmed finding this cycle. #### Outlook The near-term trajectory for Curaçao's data-protection regime turns on resolving the regulator-status question through a primary government source, such as an official gazette entry or an open-records reply, rather than through secondary characterizations. Until that is resolved, Curaçao's data-protection risk posture is best read as elevated but directionally uncertain, with the regulator, enforcement, and cross-border modules most exposed to revision. Several other modules — lawful bases and special-category processing in full detail, data subject rights, adtech and commercial privacy, algorithmic and biometric governance, and children's data — returned no independently verifiable findings for Curaçao this cycle; that silence reflects a research coverage gap rather than a finding that no such rules exist. Read full brief · 788 words ###### Latest update · 27 October 2026 #### Regulatory Status The material development for Curacao concerns a data breach at the Curacao Gaming Authority rather than at the jurisdiction's general data-protection framework. Unauthorised access to the CGA's online licensing portal, with an access window running from December 2025 to September 2026, exposed confidential beneficial-ownership and licensing data of licensees under the LOK regime. The CGA has permanently discontinued the compromised, externally-managed portal, replaced it on a temporary in-house basis, commissioned an independent forensic investigation, and filed criminal complaints with authorities in Curacao, Germany and the Netherlands. Curacao has no independent supervisory authority for the National Ordinance on the Protection of Personal Data, so it is uncertain whether any Curacao data-protection body will separately evaluate this breach; no primary evidence has surfaced confirming such a review is underway, though commentary has pointed to this as a possible oversight gap for third-party and regulator-held data. #### Outlook The conclusion of the CGA's forensic investigation is the next dated event to watch for Curacao: its findings will determine both the scope of the licensee data exposed and whether new data-security requirements follow for the regulator's own systems. No outcome has been reported as at 21 October 2026. ###### Standing brief · as of 26 August 2026 #### Regulatory Status Reports suggest the Curaçao Data Protection Board is not currently operational as the statutory supervisory authority under Ordinance No. 84 of 2010. A challenger review this cycle flagged that framing as overstated, citing contradicting reports that the Board was established in January 2022 and remained at least nominally in place before members reportedly resigned around 2023, leaving seats unfilled. Reports suggest the Board is not currently exercising investigative or enforcement powers under the Data Protection Ordinance. Ordinance No. 84 of 4 September 2010 is understood to be modeled on the Dutch data-protection implementing act structure. The Ordinance is understood to not set out requirements for data-processing notifications or filings to a supervisory authority. The Ordinance is understood to not set out requirements for DPO appointments, and is understood to not set out requirements for data breach notification to a supervisory authority or affected data subjects. On cross-border transfers, the Ordinance is understood to restrict cross-border transfer of personal data to countries not assessed as providing adequate protection, though detail on any further transfer mechanism remains unverified. Reports suggest Curaçao is a member of the Caribbean Financial Action Task Force, viewed by international supervisory bodies as having limited effective AML/tax-enforcement measures, a posture bearing on financial-sector data-sharing and due-diligence practices. #### Outlook Curaçao's overall risk posture is best read as elevated but directionally uncertain this cycle, pending resolution of the regulator-status question against a primary government source; the regulator, enforcement, and cross-border modules are the most exposed to revision, while the lawful-processing, data-subject-rights, adtech, algorithmic-governance, and children's-data modules remain uncovered pending further research. Read full brief · 487 words Key regulatory facts for Curaçao Regulatory Dimension Curaçao Standing Position Jurisdiction Curaçao (CW) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 24 sourced findings) Regulator & Framework A comprehensive-looking statute exists and is in force, but the absence of an operational supervisory authority and of registration/notification machinery materially weakens practical enforceability. Lawful Processing & Special Data Coverage gap: no verified sub-module-level detail located for this jurisdiction in this pass; only a general 'modeled on Dutch law' inference is available. Data Subject Rights No verified sub-module-level claims located for CW in this pass. Controller/Processor Duties Two concrete, confirmed negative findings (no DPO duty, no breach-notification duty) are informative but the remaining sub-modules are unverified gaps. Primary Instruments Cited DataGuidance, Curacao Chronicle, Curaçao Official Instrument (dlapiperdataprotection.com t-law-c-CW), Curacao Chronicle, Licentium Last Confirmed / Updated 2026-10-27 (14 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Curaçao: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A comprehensive-looking statute exists and is in force, but the absence of an operational supervisory authority and of registration/notification machinery materially weakens practical enforceability. Primary framework Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data (Landsverordening bescherming persoonsgegevens / Data Protection Ordinance) Supervisory authority Data Protection Board (Curaçao) — provided for by statute but not yet established Traffic-light rationale — Amber A comprehensive-looking statute exists and is in force, but the absence of an operational supervisory authority and of registration/notification machinery materially weakens practical enforceability. #### Sub-modules (5) #### Regulator And AuthorityRed The Ordinance provides for a Data Protection Board to act as supervisory authority; as of this research pass, that Board has not yet been established, leaving the regime without an operational regulator. Claims (2): - Data Protection Board (Curaçao) is reported to be not currently operational as the statutory supervisory authority under Ordinance No. 84 of 2010. CHALLENGER FOLD (f-001, add_caveat/overstated_confidence): downgraded confidence Probable->Uncertain. Contradicting T4 sources (HBN Law & Tax 2023-02-02; LawGratis 2025-04-12; Neeyamo; Artemis Qualified eLearning) report the Board was established in January 2022 and remained at least nominally operational, with a 2023 government open-records reply indicating members subsequently resigned and seats went unfilled. Correct framing is 'established 2022, lapsed ~2023', not 'never established'. - College bescherming persoonsgegevens — Landsverordening bescherming persoonsgegevens Art. 41 #### Act And InstrumentsAmber The operative instrument is Ordinance No. 84 of 4 September 2010, described by professional legal-research sources as modeled on the Dutch data-protection implementing act. Claims (3): - Ordinance No. 84 of 4 September 2010 is reported to be modeled on the Dutch data-protection implementing act structure. Single-T2-source characterization; underlying Dutch-language statute text not independently parsed this cycle. - Curacao Council of Ministers — possible legislative approaches to implementing Council of Europe Convention 108+ - Landsverordening bescherming persoonsgegevens (A.B. 2010 no. 84) — 2013-10-01 #### Material ScopeAmber The Ordinance is reported to follow the structure of the Dutch implementing act (itself derived from the pre-GDPR EU data protection directive framework), covering automated and structured-file processing of personal data, but the precise scope articles were not independently retrieved in this pass. Claims (1): - Ordinance No. 84 of 4 September 2010 covers automated and structured-file processing of personal data, per the pre-GDPR EU data protection directive-era structure inherited via the Dutch implementing act. Scope articles not independently retrieved; inference from secondary summary only. #### Territorial ScopeRed No CW-specific provision on extraterritorial application to non-established controllers was located in this research pass. #### Regulator Registration And FilingAmber The Ordinance does not set out requirements for data processing notifications to a supervisory authority. Claims (2): - Ordinance No. 84 of 4 September 2010 does not set out requirements for data-processing notifications/filings to a supervisory authority. Negative finding (absence of registration/filing machinery) reported by DataGuidance. - National Ordinance Personal Data Protection (PB 2010 no. 84) — The Ordinance sets out no data-processing notification, DPO-appointment, or registration/filing requirement. Curaçao's data protection regime rests on a single omnibus-style statute — Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data — but the supervisory authority the Ordinance itself creates, the Data Protection Board, has never been stood up. This is the textbook 'statute enacted, DPA not operational' pattern: the law is in force, yet there is no functioning regulator to receive filings, hear complaints, or issue guidance. Registration/notification duties, DPO appointment duties and breach-notification duties are all absent from the text. Periodic update · new data 2026-10-25 #### Regulator & Framework Curacao's data-protection framework rests on the Landsverordening bescherming persoonsgegevens, a national ordinance in force since 1 October 2013, which designates the College bescherming persoonsgegevens as the supervisory body under its Article 41. No primary-source confirmation that this body is operationally independent and institutionalised as a dedicated data-protection authority has been identified, a gap that is directly relevant to the external criticism described below. The principal development is procedural rather than legislative: Curacao's Council of Ministers received a presentation on 14 October 2026, prepared by an inter-ministerial working group, setting out possible legislative approaches to implementing Council of Europe Convention 108+ domestically. This is understood to be a preparatory step only. No bill text has been produced, and no firm timetable for any future legislation exists at this stage. The presentation should be read as evidence that the question of modernising Curacao's data-protection framework is now before the government at a decision-making level, not as evidence that reform has been enacted or is imminent on any confirmed date. This development sits alongside, and plausibly responds to, the Dutch Data Protection Authority's public warning that Curacao's system for protecting personal data falls significantly short of international and EU-equivalent standards and lacks effective independent oversight. The timing, a formal warning from the Kingdom's own data-protection authority followed within months by a Council of Ministers presentation on Convention 108+ approaches, suggests at minimum that external pressure is a live input into Curacao's domestic legislative agenda, though the presentation itself does not confirm that any specific reform will follow or on what basis. The practical effect of the developments is to leave the existing 2010/2013 ordinance as the operative law, unchanged, while formally opening a legislative-reform track whose outcome and timetable are both currently unknown. #### Outlook The next concrete marker will be whether the Council of Ministers' consideration of Convention 108+ approaches advances to an actual legislative proposal, and if so, on what timetable. Given the presentation is described as addressing possible approaches rather than a specific drafted instrument, a bill introduction in the near term should not be assumed. A second marker is whether any statement from Curacao's government directly addresses the Dutch AP's independence and oversight-capacity criticism, which the Convention 108+ presentation does not appear to have done directly. 1 earlier distinct update(s) Periodic update · new data 2026-10-04 #### Regulator & Framework Curacao's sole data-protection instrument is the National Ordinance Personal Data Protection (Landsverordening Bescherming Persoonsgegevens, PB 2010 no. 84), which entered into force in September 2010. The Ordinance is modelled on the Dutch GDPR-era implementing act and is closely aligned with its principles, including concepts such as a broad definition of personal data, but it is a wholly separate legal instrument from the EU General Data Protection Regulation and has not been updated to incorporate the GDPR's later-generation obligations, such as mandatory breach notification or data-protection-officer appointment. The most significant finding concerning the framework's institutional structure is that the Data Protection Board, provided for under Article 42 of the Ordinance as the body intended to supervise compliance, is understood not to have been established as an operational independent supervisory authority. The date on which this institutional gap might be resolved, or whether the Board has ever been operational at any point since 2010, was not established this cycle. This leaves open a foundational question about how the Ordinance's substantive provisions, including lawful-processing requirements, security-measures duties, and data-subject access rights, are supervised and enforced in practice, independent of the content of those substantive rules themselves. Separately, the Ordinance contains no data-processing notification, filing, or registration requirement of the kind found in many GDPR-adjacent regimes, meaning controllers operating in Curacao face no equivalent of a notification-to-regulator step before beginning processing activity. No more recent amending instrument to the Ordinance beyond its original 2010 enactment was located this cycle. #### Outlook Confirmation of whether and when the Data Protection Board has been or will be operationalised is the central open question for this module. Its resolution would clarify whether Curacao's data-protection framework currently operates with functioning independent supervision or principally as an unenforced statutory text pending institutional follow-through. Sources and claims (8) - [DataGuidance](https://www.dataguidance.com/jurisdictions/curacao) — Data Protection Board (Curaçao) is reported to be not currently operational as the statutory supervisory authority under Ordinance No. 84 of 2010. CHALLENGER FOLD (f-001, add_caveat/overstated_confidence): downgraded confidence Probable->Uncertain. Contradicting T4 sources (HBN Law & Tax 2023-02-02; LawGratis 2025-04-12; Neeyamo; Artemis Qualified eLearning) report the Board was established in January 2022 and remained at least nominally operational, with a 2023 government open-records reply indicating members subsequently resigned and seats went unfilled. Correct framing is 'established 2022, lapsed ~2023', not 'never established'. - [DataGuidance](https://www.dataguidance.com/jurisdictions/curacao) — Ordinance No. 84 of 4 September 2010 is reported to be modeled on the Dutch data-protection implementing act structure. Single-T2-source characterization; underlying Dutch-language statute text not independently parsed this cycle. - [DataGuidance](https://www.dataguidance.com/jurisdictions/curacao) — Ordinance No. 84 of 4 September 2010 covers automated and structured-file processing of personal data, per the pre-GDPR EU data protection directive-era structure inherited via the Dutch implementing act. Scope articles not independently retrieved; inference from secondary summary only. - [DataGuidance](https://www.dataguidance.com/jurisdictions/curacao) — Ordinance No. 84 of 4 September 2010 does not set out requirements for data-processing notifications/filings to a supervisory authority. Negative finding (absence of registration/filing machinery) reported by DataGuidance. - [Curacao Chronicle](https://www.curacaochronicle.com/post/unknown/curacao-government-examines-new-legislation-to-strengthen-personal-data-protection) — Curacao Council of Ministers — possible legislative approaches to implementing Council of Europe Convention 108+ - [DataGuidance](https://www.dataguidance.com/jurisdictions/curacao) — College bescherming persoonsgegevens — Landsverordening bescherming persoonsgegevens Art. 41 - [DataGuidance](https://www.dataguidance.com/jurisdictions/curacao) — Landsverordening bescherming persoonsgegevens (A.B. 2010 no. 84) — 2013-10-01 - [Curacao Chronicle](https://www.curacaochronicle.com/post/unknown/curacao-government-examines-new-legislation-to-strengthen-personal-data-protection) — National Ordinance Personal Data Protection (PB 2010 no. 84) — The Ordinance sets out no data-processing notification, DPO-appointment, or registration/filing requirement. ### Curaçao: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ Coverage gap: no verified sub-module-level detail located for this jurisdiction in this pass; only a general 'modeled on Dutch law' inference is available. Primary framework Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data Traffic-light rationale — Red Coverage gap: no verified sub-module-level detail located for this jurisdiction in this pass; only a general 'modeled on Dutch law' inference is available. D2 · Lawful Processing — Full Module Record 4 sub-modules · 65 words · 1 traced claims · Re-verified 2026-10-27 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Curaçao: D3 Data Subject Rights 5 sub-modules Not assessed ▾ No verified sub-module-level claims located for CW in this pass. Primary framework Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data Traffic-light rationale — Not assessed No verified sub-module-level claims located for CW in this pass. #### Sub-modules (5) #### Access RightRed Not independently verified for CW in this pass. #### Rectification And ErasureRed Not independently verified for CW in this pass. #### Restriction And ObjectionRed Not independently verified for CW in this pass. #### Data PortabilityRed Not independently verified for CW in this pass; the source statute predates the GDPR-era portability right by design lineage. #### Deadlines And Response WindowsRed Not independently verified for CW in this pass. No Curaçao-specific detail on access, rectification/erasure, restriction/objection, portability, or statutory response deadlines was retrieved in this research pass; the underlying Ordinance text is Dutch-only and was not independently parsed article-by-article. ### Curaçao: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Two concrete, confirmed negative findings (no DPO duty, no breach-notification duty) are informative but the remaining sub-modules are unverified gaps. Primary framework Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data Supervisory authority Data Protection Board (Curaçao) — not yet established Traffic-light rationale — Amber Two concrete, confirmed negative findings (no DPO duty, no breach-notification duty) are informative but the remaining sub-modules are unverified gaps. Periodic update · new data 2026-10-18 #### Controller/Processor Duties The standing statutory duty on controllers, termed responsible parties under the 2010 National Ordinance Personal Data Protection, is set out at Article 13: a responsible party must execute appropriate technical and organizational measures to secure personal data against loss or any form of unlawful processing, with the level of security guaranteed calibrated to the state of the art, cost of execution, and the risks associated with the processing. This duty is confirmed and unchanged this cycle. What is new, and material, is what appears absent around it. The breach of the Curacao Gaming Authority's online licensing portal, confirmed by the CGA on 7 October 2026, exposed approximately 40,000 documents covering beneficial-ownership and identification data for nearly 650 licensed companies. No statutory breach-notification duty to a regulator or to affected data subjects, of the kind found in GDPR Articles 33 and 34, has been located under the 2010 Ordinance, and no response from the Personal Data Protection Committee to this breach has been identified. These two findings together describe a controller-duties landscape with a security-measures obligation on paper but no confirmed notification mechanism or regulatory follow-through observed in this specific instance. #### Outlook Whether the Personal Data Protection Committee responds to the CGA breach, and whether any notification duty is identified on fuller review of the Ordinance's primary text, are the two open questions carried forward from this cycle. D4 · Controller & Processor — Full Module Record 7 sub-modules · 30 words · 5 traced claims · Re-verified 2026-10-27 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Curaçao: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The core adequacy-based transfer restriction is confirmed and binding; downstream transfer-mechanism detail (SCCs, BCRs, TIA, localisation) is an unverified gap. Primary framework Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data Supervisory authority Data Protection Board (Curaçao) — not yet established Traffic-light rationale — Amber The core adequacy-based transfer restriction is confirmed and binding; downstream transfer-mechanism detail (SCCs, BCRs, TIA, localisation) is an unverified gap. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 44 words · 3 traced claims · Re-verified 2026-10-27 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Curaçao: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ One confirmed financial-sector/AML-adjacent finding; remaining sectoral sub-modules are unverified gaps. Primary framework Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data Traffic-light rationale — Amber One confirmed financial-sector/AML-adjacent finding; remaining sectoral sub-modules are unverified gaps. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 52 words · 1 traced claims · Re-verified 2026-10-27 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Curaçao: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No sub-module findings located; comprehensive gap for this module in this jurisdiction. Traffic-light rationale — Not assessed No sub-module findings located; comprehensive gap for this module in this jurisdiction. #### Sub-modules (6) #### Cookies And TrackersRed No CW-specific cookie/tracker regime located. #### Dark PatternsRed No CW-specific dark-pattern prohibition located. #### Opt Out SignalsRed No CW-specific opt-out signal recognition (e.g., GPC) located. #### Clean Rooms And DcrRed No CW-specific clean-room/data-collaboration rules located. #### Cross Context AdvertisingRed No CW-specific cross-context-advertising ('sale'/'share') rule located. #### Direct MarketingRed No CW-specific direct-marketing consent/suppression rule located. No Curaçao-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rules, cross-context-advertising rules, or direct-marketing consent/suppression rules were located in this research pass. ### Curaçao: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sub-module findings located; comprehensive gap for this module in this jurisdiction. Traffic-light rationale — Red No sub-module findings located; comprehensive gap for this module in this jurisdiction. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 16 words · 1 traced claims · Re-verified 2026-10-27 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Curaçao: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No sub-module findings located; comprehensive gap for this module in this jurisdiction. Traffic-light rationale — Not assessed No sub-module findings located; comprehensive gap for this module in this jurisdiction. #### Sub-modules (5) #### Age VerificationRed No CW-specific age-verification rule located. #### Parental ConsentRed No CW-specific parental-consent mechanism located. #### Minor Profiling BansRed No CW-specific minor-profiling ban located. #### Education SettingsRed No CW-specific education-setting DP rule located. #### Dependent AdultsRed No CW-specific dependent-adult protection rule located. No Curaçao-specific age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection was located in this research pass. ### Curaçao: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No operational regulator and no confirmed enforcement track record under the Ordinance. Primary framework Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data Supervisory authority Data Protection Board (Curaçao) — not yet established Traffic-light rationale — Red No operational regulator and no confirmed enforcement track record under the Ordinance. Periodic update · new data 2026-10-25 #### Enforcement & Redress Curacao's data-protection ordinance provides for administrative fines of up to NAf./Cg 10,000 under Article 54, alongside a criminal offence carrying up to six months imprisonment for intentional breach under Article 63. These penalty levels are unchanged and represent the standing enforcement architecture under the 2010/2013 statute. The more significant development in this domain is not a change to the penalty provisions themselves but the Dutch Data Protection Authority's explicit characterisation of Curacao's oversight capacity as lacking. The Dutch AP has warned that Curacao's system for protecting personal data falls significantly short of international and EU-equivalent standards and lacks effective independent oversight. Read against the modest administrative-fine ceiling and the absence of any confirmed general breach-notification duty, this criticism suggests the enforcement and redress architecture available under the current ordinance may be under-resourced relative to the scale and sensitivity of personal data now processed in and through Curacao, though no primary-source information on actual enforcement activity, case volumes, or the supervisory body's budget or staffing has been identified to confirm this directly. This criticism arrives in the same period as a separate, though unconnected within this domain, demonstration of oversight-capacity strain: a prolonged unauthorised-access incident at a Curacao sector regulator's licensing system. While that incident falls outside this module's scope and is addressed elsewhere, its timing lends some concrete texture to the Dutch AP's otherwise general warning about oversight adequacy. #### Outlook The principal marker to watch is whether Curacao's government responds formally to the Dutch AP's criticism, whether through the Convention 108+ legislative track or through some other confirmation of the College bescherming persoonsgegevens' resourcing and independence. Absent such a response, the existing fine and criminal-penalty framework, together with an unconfirmed supervisory-independence status, remains the operative enforcement picture. Periodic update · new data 2026-10-18 #### Enforcement & Redress The most significant data-protection-relevant development of the past 180 days for Curacao is the absence of an enforcement or redress response, not its presence. The Personal Data Protection Committee, Curacao's designated data-protection authority under Article 42 of the 2010 National Ordinance Personal Data Protection, has not been identified as having issued any statement, opened any investigation, or taken any enforcement step in response to the Curacao Gaming Authority's licensing-portal breach, which exposed roughly 40,000 documents including ownership and identity data for nearly 650 licensed companies. Separately, as of the most recent available legal guide reviewed, no local key decisions applying the Personal Data Protection Ordinance were known to the contributing firm, a finding that reflects the absence of a known enforcement record as of that source's publication date rather than a confirmed current-state absence. Taken together, these findings reinforce a standing concern that Curacao's data-protection regulator has not demonstrated confirmed independent institutional enforcement capacity, a concern now sharpened by its apparent non-engagement with a breach of significant scale. #### Outlook The item to watch is whether the Personal Data Protection Committee breaks its apparent silence on the CGA breach. Continued non-engagement would further reinforce the standing capacity concern; any public statement or investigation would be the first identified enforcement-adjacent activity from the Committee in the material reviewed. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 84 words · 5 traced claims · Re-verified 2026-10-27 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (14 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 13-22 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties