Gibraltar: Data Subject Rights

Chapter III (Arts. 12–23) of the Gibraltar GDPR confers the full suite of data subject rights: transparent privacy notices (Arts. 13–14), subject access (Art. 15 DSAR), rectification (Art. 16), erasure / right to be forgotten (Art. 17), restriction of processing (Art. 18), notification of rectification/erasure/restriction (Art. 19), data portability in a structured, commonly used, machine-readable format where processing is automated and based on consent or contract (Art. 20), objection to public-task or legitimate-interests processing and an absolute right to object to direct marketing (Art. 21), and protection against solely automated decision-making including profiling (Art. 22). Under Art. 12(3) Gibraltar GDPR, controllers must respond without undue delay and within one calendar month of receipt, extendable by up to two further months for complex or numerous requests provided the data subject is notified of the extension and reasons within the initial month. Requests are free of charge unless 'manifestly unfounded or excessive' (Art. 12(5)). Statutory exemptions to Chapter III rights are set out in Schedules 2, 3, and 4 to the DPA 2004, covering crime and taxation, regulatory functions of the GFSC, GRA, and Gambling Division, legal professional privilege, judicial independence, journalism/academic/artistic expression, management forecasts, corporate finance, negotiations, confidential references, and health/social work/education records.