Data Protection Monitor
Global Privacy & Data Protection Intelligence

Gibraltar (GI) · Module Detail

Gibraltar: Cross-Border & Adequacy

← Full Gibraltar overview Build report with Gibraltar Request deeper dive

#

Bidirectional UK–Gibraltar transfers flow freely by statute, and outbound Gibraltar-to-EEA transfers are permitted under Schedule 21 DPA 2004; however, inbound EEA-to-Gibraltar transfers continue to require Art. 46 EU GDPR safeguards (such as EU 2021 SCCs) pending formal European Commission adequacy under the UK–EU Gibraltar Treaty (political agreement reached 11 June 2025, final draft legal text published 2026).

Primary frameworkGibraltar GDPR Arts 44-49; UK Data Protection (Adequacy) framework
Supervisory authorityGibraltar Regulatory Authority (GRA)
Traffic-light rationale — AmberBidirectional UK–Gibraltar transfers flow freely by statute, and outbound Gibraltar-to-EEA transfers are permitted under Schedule 21 DPA 2004; however, inbound EEA-to-Gibraltar transfers continue to require Art. 46 EU GDPR safeguards (such as EU 2021 SCCs) pending formal European Commission adequacy under the UK–EU Gibraltar Treaty (political agreement reached 11 June 2025, final draft legal text published 2026).

Sub-modules (6)

Category narrative271 words

Gibraltar's cross-border transfer profile is asymmetrically structured across the UK and the EEA. First, between the United Kingdom and Gibraltar, personal data flows unrestricted in both directions: the UK grants statutory adequacy to Gibraltar under Schedule 21 para. 4(2)(b) to the UK Data Protection Act 2018 (retained via the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019), and Gibraltar reciprocally designates the UK, EEA Member States, and EU-adequate third countries as adequate for outbound transfers from Gibraltar under Chapter V Gibraltar GDPR and Schedule 21 to the Gibraltar DPA 2004. Second, for inbound transfers FROM the EEA TO Gibraltar, the European Commission's UK adequacy decisions (28 June 2021 and the 19 December 2025 renewals under Implementing Decisions (EU) 2025/2545 and 2025/2546) explicitly exclude Gibraltar from their territorial scope. Consequently, EEA controllers/processors transferring personal data to Gibraltar must currently rely on an Art. 46 EU GDPR transfer mechanism — primarily the European Commission's 2021 Standard Contractual Clauses (Decision (EU) 2021/914) or EU Binding Corporate Rules — supported by a Transfer Impact Assessment, unless an Art. 49 derogation applies. On 11 June 2025, the UK, European Commission, Spain, and Gibraltar reached political agreement on the UK–EU Treaty in respect of Gibraltar (with the final draft legal text published in 2026), which provides the treaty pathway for EEA data-flow alignment and an EU adequacy bridge upon ratification. For outbound transfers from Gibraltar to non-adequate third countries (e.g., US non-DPF recipients, India, APAC), Gibraltar exporters rely on Art. 46 Gibraltar GDPR appropriate safeguards (adapted EU SCCs / UK IDTA framework per GRA guidance or approved BCRs) plus a Transfer Risk Assessment.

Sources and claims (4)
  1. Confirmedunavailable — Personal data flows freely between the UK and Gibraltar under UK DPA 2018 Schedule 21 para. 4(2)(b) and Gibraltar DPA 2004 Schedule 21, while inbound EEA-to-Gibraltar transfers require EU Art. 46 safeguards (such as the 2021 EU SCCs) pending formal EU adequacy under the UK–EU Gibraltar Treaty.
  2. ConfirmedOneTrust DataGuidance — In the absence of an EU adequacy decision for Gibraltar, GRA's Transfers Guidance directs that EEA controllers transferring to Gibraltar should rely on Article 46 GDPR safeguards, including Standard Contractual Clauses and Binding Corporate Rules.observed
  3. ConfirmedICO — The UK ICO lists Gibraltar among the countries and territories covered by full UK adequacy regulations, permitting restricted transfers from the UK to Gibraltar without additional safeguards; Gibraltar-based organisations may also rely on the UK Extension to the EU-US Data Privacy Framework for transfers to certain self-certified US businesses.observed
  4. ConfirmedOneTrust DataGuidance — As of the guidance reviewed, the Government of Gibraltar intended to seek an EU adequacy decision to ensure continuing free flow of data from the EEA to Gibraltar, but no such decision had been finalised at that time.observed