--- title: "Gibraltar — Controller/Processor Duties | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/gibraltar/controller-processor-duties/ source_html: /jurisdictions/gibraltar/controller-processor-duties/index.html description: "Gibraltar — Controller/Processor Duties (Amber, 7 sub-modules, 6 claims): Strong enforcement record evidences the regime" generated_at: 2026-10-25T04:46:50Z content_sha256: ae7cc03efc1e746c6b7db381337a74224a71a5769020f4be9b69c3820f995870 generator: "fe-fleet/md-twin@1.0" --- # Gibraltar — Controller/Processor Duties | Data Protection Monitor ### D4Controller/Processor Duties7 sub-modules6 claimsAmber▾# Strong enforcement record evidences the regime's teeth, but DPO-appointment thresholds and joint-controller-specific Gibraltar guidance were not located. Primary framework Data Protection Act 2004 (as amended) Part III; Gibraltar GDPR Arts 24-39 Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection) Traffic-light rationale — Amber Strong enforcement record evidences the regime's teeth, but DPO-appointment thresholds and joint-controller-specific Gibraltar guidance were not located. #### Sub-modules (7) Category narrative 239 words Chapter IV (Arts. 24–43) of the Gibraltar GDPR imposes identical accountability, governance, and security obligations to the EU and UK GDPR baselines: controllers must implement Data Protection by Design and by Default (Art. 25), execute binding written processor agreements containing all Art. 28(3) clauses, maintain written electronic Records of Processing Activities (Art. 30 ROPA, with the <250-employee exemption under Art. 30(5) disapplied for non-occasional, special-category, or risk-bearing processing), transparently allocate responsibilities in Joint Controller arrangements (Art. 26), and implement risk-proportionate technical and organisational security measures (Art. 32). Designation of a Data Protection Officer (Arts. 37–39) is mandatory for public authorities, controllers/processors whose core activities involve regular and systematic monitoring on a large scale, or large-scale processing of Art. 9/10 data — a threshold routinely triggered across Gibraltar's licensed remote gambling (B2C/B2B), distributed ledger technology (DLT), e-money, banking, and insurance sectors — with DPO details notified to the GRA under Art. 37(7). Data Protection Impact Assessments (Art. 35 DPIA) are mandatory prior to high-risk processing (including large-scale player behavioural/affordability profiling, biometric onboarding, AI deployment, and systematic CCTV/workplace monitoring per GRA DPIA guidance). Personal data breaches must be notified to the GRA within 72 hours under Art. 33 unless unlikely to result in a risk, and communicated to affected individuals without undue delay under Art. 34 where high risk is likely; telecoms/ISP providers face an immediate 24-hour notification obligation under Reg. 5A of the Communications (Personal Data and Privacy) Regulations 2006. Evidence 6 Sources and claims (6) - Confirmedunavailable — Controllers must notify personal data breaches to the GRA within 72 hours under Art. 33 Gibraltar GDPR unless unlikely to result in a risk, while public electronic communications providers must notify the GRA within 24 hours under Reg. 5A of the Communications (Personal Data and Privacy) Regulations 2006. - Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/notes/gibraltar-data-protection-impact-assessment) — Sections 73 and 74 of the Data Protection Act 2004 (as amended in 2019), read with recitals 4, 75, 76, 84, 90, 92 and Article 35 of the GDPR, impose data protection impact assessment obligations in Gibraltar.observed 2026-08-05 - Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-fines-royal-gibraltar-police-%C2%A310000) — The GRA's 18 April 2022 decision fined the Royal Gibraltar Police £10,000 partly for failures relating to records of processing activities, in violation of Article 30 GDPR and corresponding DPA 2004 sections.observed 2026-08-05 - Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-issues-data-security-guidance-under-gdpr) — GRA's 19 March 2020 guidance emphasises that organisations are accountable for establishing appropriate security measures and must adopt a risk-based approach, highlighting certification, third-party audits, breach management and multi-factor authentication.observed 2026-08-05 - Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-fines-royal-gibraltar-police-%C2%A310000) — The Royal Gibraltar Police was fined £10,000 for, among other violations, breaching Sections 65(1)-(2), 70, 75 and 77(1)-(2) of the DPA 2004 and Articles 24(1)-(2), 30, 32 and 34(1)-(2) GDPR concerning breach communication and security, having notified the GRA and data subjects only after delay.observed 2026-08-05 - Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-fines-royal-gibraltar-police-%C2%A310000) — The GRA's 2022 fine decision cited storage-limitation failures under Section 48(1)-(2) DPA 2004 and Article 5(1)(e) GDPR against the Royal Gibraltar Police.observed 2026-08-05