Gibraltar Data Protection & Privacy Regulation

Gibraltar's data protection regime is governed by the Data Protection Act 2004 (DPA 2004, Act No. 2004-01, substantially restructured on 25 May 2018 and amended at post-Brexit transition on 1 January 2021 by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019), the retained Gibraltar General Data Protection Regulation (Gibraltar GDPR), and the Communications (Personal Data and Privacy) Regulations 2006 (CPDPR 2006, LN 2006/126, enacted under the Communications Act 2006). The Gibraltar Regulatory Authority (GRA), established under the Gibraltar Regulatory Authority Act 2000, is designated under s.129 DPA 2004 as the Information Commissioner and exercises independent supervisory, investigative, and enforcement functions across all six parts of the DPA 2004 (Part II general processing supplementing the Gibraltar GDPR; Part III law enforcement processing by competent authorities transposing Directive (EU) 2016/680; Part V Information Commissioner functions; Part VI enforcement and offences). Material and territorial scope mirror Art. 2 and Art. 3 GDPR: the Gibraltar GDPR applies to controllers and processors established in Gibraltar (Art. 3(1)) and extraterritorially to non-Gibraltar entities offering goods or services to, or monitoring the behaviour of, individuals in Gibraltar (Art. 3(2)), who must appoint a Gibraltar Representative under Art. 27 unless exempt. Following the 2018 GDPR reforms, Gibraltar abolished routine controller registration and annual data-protection fee filings; controllers instead maintain internal Art. 30 Records of Processing Activities (ROPA) and notify the GRA only when designating a Data Protection Officer (Art. 37(7)), reporting a personal data breach (Art. 33), or seeking Art. 36 prior consultation.

Processing of personal data in Gibraltar requires one of the six lawful bases in Art. 6(1)(a)–(f) Gibraltar GDPR (consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests supported by a three-stage Legitimate Interests Assessment). Note that the UK's Data (Use and Access) Act 2025 is an Act of the UK Parliament and does NOT extend to Gibraltar: Gibraltar GDPR continues to operate the unamended six Art. 6(1) bases without a separate 'recognised legitimate interests' annex. Consent under Art. 4(11) and Art. 7 Gibraltar GDPR must be freely given, specific, informed, unambiguous, and unbundled. Special category data under Art. 9 Gibraltar GDPR and criminal convictions/offences data under Art. 10 Gibraltar GDPR and s.15 DPA 2004 must satisfy a condition in Schedule 1 to the DPA 2004 (Part 1 employment, health, archiving, and research conditions; Part 2 substantial public interest conditions, including statutory functions, preventing/detecting unlawful acts, regulatory requirements across financial services and gaming, anti-money laundering, insurance, and safeguarding; Part 3 criminal convictions extensions), which generally require the controller to maintain an Appropriate Policy Document (APD) under Schedule 1 Part 4 explaining compliance with the Art. 5 principles and retention/erasure policies. Pseudonymised data remains personal data under Art. 4(5) Gibraltar GDPR, whereas irreversibly anonymised data passing the 'all means reasonably likely to be used' test falls outside statutory scope.

Chapter III (Arts. 12–23) of the Gibraltar GDPR confers the full suite of data subject rights: transparent privacy notices (Arts. 13–14), subject access (Art. 15 DSAR), rectification (Art. 16), erasure / right to be forgotten (Art. 17), restriction of processing (Art. 18), notification of rectification/erasure/restriction (Art. 19), data portability in a structured, commonly used, machine-readable format where processing is automated and based on consent or contract (Art. 20), objection to public-task or legitimate-interests processing and an absolute right to object to direct marketing (Art. 21), and protection against solely automated decision-making including profiling (Art. 22). Under Art. 12(3) Gibraltar GDPR, controllers must respond without undue delay and within one calendar month of receipt, extendable by up to two further months for complex or numerous requests provided the data subject is notified of the extension and reasons within the initial month. Requests are free of charge unless 'manifestly unfounded or excessive' (Art. 12(5)). Statutory exemptions to Chapter III rights are set out in Schedules 2, 3, and 4 to the DPA 2004, covering crime and taxation, regulatory functions of the GFSC, GRA, and Gambling Division, legal professional privilege, judicial independence, journalism/academic/artistic expression, management forecasts, corporate finance, negotiations, confidential references, and health/social work/education records.

Chapter IV (Arts. 24–43) of the Gibraltar GDPR imposes identical accountability, governance, and security obligations to the EU and UK GDPR baselines: controllers must implement Data Protection by Design and by Default (Art. 25), execute binding written processor agreements containing all Art. 28(3) clauses, maintain written electronic Records of Processing Activities (Art. 30 ROPA, with the <250-employee exemption under Art. 30(5) disapplied for non-occasional, special-category, or risk-bearing processing), transparently allocate responsibilities in Joint Controller arrangements (Art. 26), and implement risk-proportionate technical and organisational security measures (Art. 32). Designation of a Data Protection Officer (Arts. 37–39) is mandatory for public authorities, controllers/processors whose core activities involve regular and systematic monitoring on a large scale, or large-scale processing of Art. 9/10 data — a threshold routinely triggered across Gibraltar's licensed remote gambling (B2C/B2B), distributed ledger technology (DLT), e-money, banking, and insurance sectors — with DPO details notified to the GRA under Art. 37(7). Data Protection Impact Assessments (Art. 35 DPIA) are mandatory prior to high-risk processing (including large-scale player behavioural/affordability profiling, biometric onboarding, AI deployment, and systematic CCTV/workplace monitoring per GRA DPIA guidance). Personal data breaches must be notified to the GRA within 72 hours under Art. 33 unless unlikely to result in a risk, and communicated to affected individuals without undue delay under Art. 34 where high risk is likely; telecoms/ISP providers face an immediate 24-hour notification obligation under Reg. 5A of the Communications (Personal Data and Privacy) Regulations 2006.

Gibraltar's cross-border transfer profile is asymmetrically structured across the UK and the EEA. First, between the United Kingdom and Gibraltar, personal data flows unrestricted in both directions: the UK grants statutory adequacy to Gibraltar under Schedule 21 para. 4(2)(b) to the UK Data Protection Act 2018 (retained via the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019), and Gibraltar reciprocally designates the UK, EEA Member States, and EU-adequate third countries as adequate for outbound transfers from Gibraltar under Chapter V Gibraltar GDPR and Schedule 21 to the Gibraltar DPA 2004. Second, for inbound transfers FROM the EEA TO Gibraltar, the European Commission's UK adequacy decisions (28 June 2021 and the 19 December 2025 renewals under Implementing Decisions (EU) 2025/2545 and 2025/2546) explicitly exclude Gibraltar from their territorial scope. Consequently, EEA controllers/processors transferring personal data to Gibraltar must currently rely on an Art. 46 EU GDPR transfer mechanism — primarily the European Commission's 2021 Standard Contractual Clauses (Decision (EU) 2021/914) or EU Binding Corporate Rules — supported by a Transfer Impact Assessment, unless an Art. 49 derogation applies. On 11 June 2025, the UK, European Commission, Spain, and Gibraltar reached political agreement on the UK–EU Treaty in respect of Gibraltar (with the final draft legal text published in 2026), which provides the treaty pathway for EEA data-flow alignment and an EU adequacy bridge upon ratification. For outbound transfers from Gibraltar to non-adequate third countries (e.g., US non-DPF recipients, India, APAC), Gibraltar exporters rely on Art. 46 Gibraltar GDPR appropriate safeguards (adapted EU SCCs / UK IDTA framework per GRA guidance or approved BCRs) plus a Transfer Risk Assessment.

Sectoral data protection governance in Gibraltar is tightly integrated with its primary regulated industries: financial services, distributed ledger technology (DLT), remote gambling, electronic communications, health, and employment. Financial services, insurance, e-money, payment services, and DLT providers regulated by the Gibraltar Financial Services Commission (GFSC) under the Financial Services Act 2019 (Act 2019-26) and the Financial Services (Distributed Ledger Technology Providers) Regulations 2020 must reconcile Gibraltar GDPR data minimisation and erasure duties with mandatory customer due diligence (CDD), transaction monitoring, Travel Rule, and 5-year statutory record retention under the Proceeds of Crime Act 2015 (POCA 2015, s.25), relying on Art. 6(1)(c) legal obligation and DPA 2004 Schedule 1 Part 2 AML/regulatory conditions. Remote gambling operators licensed under the Gambling Act 2005 (and the incoming Gambling Act reform framework) conduct extensive AML, safer-gambling behavioural monitoring, and affordability profiling under licence conditions supervised by the Gambling Commissioner alongside the GRA. Electronic communications and ePrivacy are governed by the Communications (Personal Data and Privacy) Regulations 2006 (LN 2006/126). Public healthcare is delivered by the Gibraltar Health Authority (GHA) under the Medical (Gibraltar Health Authority) Act 1987 alongside private clinics under Art. 9(2)(h) and DPA 2004 Schedule 1 Part 1 para. 2. Employment processing is governed by the Employment Act, the Bullying at Work Act 2014, and GRA workplace monitoring guidance.

Electronic marketing, cookies, and online tracking in Gibraltar are governed by the Communications (Personal Data and Privacy) Regulations 2006 (CPDPR 2006, LN 2006/126) read alongside the Gibraltar GDPR. Under Reg. 6 CPDPR 2006, storing information or gaining access to information stored in the terminal equipment of a subscriber or user (cookies, SDKs, tracking pixels, device fingerprinting) is permitted only where the user has been provided with clear and comprehensive information about the purposes of the storage/access and given consent (to the Gibraltar GDPR Art. 4(11) / Art. 7 affirmative opt-in standard), except for technical storage/access for the sole purpose of carrying out the transmission of a communication or where strictly necessary to provide an information society service explicitly requested by the user. Note that the UK's DUAA 2025 Schedule 12 analytics/preference cookie exemptions do NOT apply in Gibraltar: non-essential analytics and advertising cookies continue to require prior opt-in consent. Direct marketing by electronic mail (email, SMS, push/in-app messages) to individual subscribers requires prior opt-in consent under Reg. 23 CPDPR 2006 unless the commercial 'soft opt-in' under Reg. 23(3) applies (contact details obtained in the course of a sale or negotiations for the sale of a product or service, marketing the controller's own similar products/services, with a free opt-out offered at collection and in every subsequent communication). Unsolicited automated calling systems require prior opt-in (Reg. 20), and live unsolicited marketing calls must respect subscriber opt-out objections and directory preference markings (Reg. 22). Every marketing communication must identify the sender and provide a valid opt-out address (Reg. 24), and Art. 21(2)–(3) Gibraltar GDPR confers an absolute right to object to direct marketing and profiling for direct marketing at any time.

Gibraltar retains the unamended Art. 22 Gibraltar GDPR prohibition on solely automated decision-making, including profiling, that produces legal effects concerning a data subject or similarly significantly affects them (the UK's DUAA 2025 Arts. 22A–22D relaxation does NOT apply in Gibraltar). Under Art. 22(2) Gibraltar GDPR and s.19 DPA 2004, solely automated significant decisions are permitted only where (a) necessary for entering into or performing a contract between the data subject and controller, (b) authorised by Gibraltar law laying down suitable safeguards (subject to s.19 DPA 2004 written notification and 21-day reconsideration rights), or (c) based on the data subject's explicit consent, and in cases (a) and (c) the controller must implement suitable safeguards including the right to obtain human intervention, express the data subject's point of view, and contest the decision (Art. 22(3)). Solely automated decisions based on Art. 9 special category data are prohibited under Art. 22(4) unless explicit consent or substantial public interest (Art. 9(2)(a) or (g)) applies. This framework directly governs automated AML/fraud blocking, affordability scoring, and responsible-gambling interventions across Gibraltar's licensed gaming and fintech sectors: where a system automatically suspends an account or refuses service without meaningful human review, Art. 22(3) / s.19 DPA 2004 safeguards and Arts. 13(2)(f)/14(2)(g)/15(1)(h) logic-transparency disclosures apply. Biometric data processed for unique identification (e.g., facial recognition KYC liveness checks or workplace biometric access) is Art. 9(1) special category data requiring explicit consent or a Schedule 1 DPA 2004 condition plus an Art. 35 DPIA, while CCTV and video surveillance are governed by the GRA's dedicated CCTV Guidance.

No Gibraltar-specific age-of-consent, parental-consent mechanism, minor-profiling ban, or dependent-adults provision was independently located in this pass, beyond the general education-sector exemption referenced in GRA's exemptions guidance.

Part VI (ss.135–183) of the Data Protection Act 2004 and Art. 83 Gibraltar GDPR vest the GRA (as Information Commissioner) with comprehensive investigative, corrective, and fining powers: Information Notices (s.136), Assessment Notices including compulsory inspection and audit powers (s.140), Enforcement Notices requiring specific compliance steps or ordering suspension of processing/transfers (s.142), and Penalty Notices (s.147). Administrative fine ceilings under Art. 83 Gibraltar GDPR and s.149 DPA 2004 mirror the GDPR two-tier structure converted into Pound Sterling: up to £8,700,000 or 2% of total worldwide annual turnover (standard tier, Art. 83(4)) and up to £17,500,000 or 4% of total worldwide annual turnover (higher tier, Art. 83(5)–(6)). In addition, the DPA 2004 creates criminal offences for unlawfully obtaining, disclosing, or retaining personal data without the controller's consent (s.162), re-identifying de-identified personal data (s.163), altering/concealing records with intent to prevent DSAR disclosure (s.165), enforcing unlawful forced subject access requests as a condition of employment/service (s.176), and obstructing or making false statements to the Commissioner (Sch. 15). Under s.154 DPA 2004, appeals against GRA Information, Assessment, Enforcement, or Penalty Notices lie to the Magistrates' Court (and onward to the Supreme Court of Gibraltar). Data subjects have a direct statutory right to lodge complaints with the GRA (Art. 77 / s.157 DPA 2004), seek judicial compliance orders in the Supreme Court of Gibraltar (Art. 79 / s.159 DPA 2004), claim compensation for material and non-material damage (including distress) under Art. 82 Gibraltar GDPR and s.160 DPA 2004, and mandate non-profit representative bodies on an opt-in basis under Art. 80(1) Gibraltar GDPR and s.178 DPA 2004.