---
title: "Gibraltar — Data Subject Rights | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/gibraltar/data-subject-rights/
source_html: /jurisdictions/gibraltar/data-subject-rights/index.html
description: "Gibraltar — Data Subject Rights (Amber, 5 sub-modules, 3 claims): Rights framework is GDPR-aligned and actively enforced (SAR failures investigated) but Gibraltar-specific procedural guidance on erasure/portability/deadlines was not located"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 4fce68681055f2eaf98b3a12c86cde08aa85efe1d2991f92b780cfb9c6bc3f29
generator: "fe-fleet/md-twin@1.0"
---
# Gibraltar — Data Subject Rights | Data Protection Monitor

### D3Data Subject Rights5 sub-modules3 claimsAmber▾#

Rights framework is GDPR-aligned and actively enforced (SAR failures investigated) but Gibraltar-specific procedural guidance on erasure/portability/deadlines was not located in this pass.

Primary framework Gibraltar GDPR Arts 12-22

Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection)

Traffic-light rationale — Amber Rights framework is GDPR-aligned and actively enforced (SAR failures investigated) but Gibraltar-specific procedural guidance on erasure/portability/deadlines was not located in this pass.

#### Sub-modules (5)

Category narrative 202 words

Chapter III (Arts. 12–23) of the Gibraltar GDPR confers the full suite of data subject rights: transparent privacy notices (Arts. 13–14), subject access (Art. 15 DSAR), rectification (Art. 16), erasure / right to be forgotten (Art. 17), restriction of processing (Art. 18), notification of rectification/erasure/restriction (Art. 19), data portability in a structured, commonly used, machine-readable format where processing is automated and based on consent or contract (Art. 20), objection to public-task or legitimate-interests processing and an absolute right to object to direct marketing (Art. 21), and protection against solely automated decision-making including profiling (Art. 22). Under Art. 12(3) Gibraltar GDPR, controllers must respond without undue delay and within one calendar month of receipt, extendable by up to two further months for complex or numerous requests provided the data subject is notified of the extension and reasons within the initial month. Requests are free of charge unless 'manifestly unfounded or excessive' (Art. 12(5)). Statutory exemptions to Chapter III rights are set out in Schedules 2, 3, and 4 to the DPA 2004, covering crime and taxation, regulatory functions of the GFSC, GRA, and Gambling Division, legal professional privilege, judicial independence, journalism/academic/artistic expression, management forecasts, corporate finance, negotiations, confidential references, and health/social work/education records.

Evidence 3

Sources and claims (3)
- Confirmedunavailable — Under Art. 12(3) Gibraltar GDPR, controllers must respond to data subject rights requests within one calendar month (extendable by up to two further months for complex or numerous requests), subject to statutory exemptions in Schedules 2–4 to the Data Protection Act 2004.
- Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-reports-enforcement-activity) — GRA's published investigations and enforcement report addresses cases involving failure to respond to subject access requests, among other compliance failures under GDPR and the DPA 2004.observed 2026-08-05
- Probable[Gibraltar Regulatory Authority](https://www.gra.gi/data-protection) — The Gibraltar GDPR retains the GDPR Article 12(3) standard one-month response deadline for data subject requests, extendable by two further months for complex/numerous requests.observed 2026-08-05