Gibraltar: Controller/Processor Duties

Chapter IV (Arts. 24–43) of the Gibraltar GDPR imposes identical accountability, governance, and security obligations to the EU and UK GDPR baselines: controllers must implement Data Protection by Design and by Default (Art. 25), execute binding written processor agreements containing all Art. 28(3) clauses, maintain written electronic Records of Processing Activities (Art. 30 ROPA, with the <250-employee exemption under Art. 30(5) disapplied for non-occasional, special-category, or risk-bearing processing), transparently allocate responsibilities in Joint Controller arrangements (Art. 26), and implement risk-proportionate technical and organisational security measures (Art. 32). Designation of a Data Protection Officer (Arts. 37–39) is mandatory for public authorities, controllers/processors whose core activities involve regular and systematic monitoring on a large scale, or large-scale processing of Art. 9/10 data — a threshold routinely triggered across Gibraltar's licensed remote gambling (B2C/B2B), distributed ledger technology (DLT), e-money, banking, and insurance sectors — with DPO details notified to the GRA under Art. 37(7). Data Protection Impact Assessments (Art. 35 DPIA) are mandatory prior to high-risk processing (including large-scale player behavioural/affordability profiling, biometric onboarding, AI deployment, and systematic CCTV/workplace monitoring per GRA DPIA guidance). Personal data breaches must be notified to the GRA within 72 hours under Art. 33 unless unlikely to result in a risk, and communicated to affected individuals without undue delay under Art. 34 where high risk is likely; telecoms/ISP providers face an immediate 24-hour notification obligation under Reg. 5A of the Communications (Personal Data and Privacy) Regulations 2006.