--- title: "Gibraltar Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/gibraltar/ source_html: /jurisdictions/gibraltar/index.html description: "Gibraltar data protection and privacy regulation: 10 categories, 38 claims, updated 2026-11-03. Lawful processing, data subject rights, cross-border…" generated_at: 2026-11-04T02:23:31Z content_sha256: 21a0bba2e2aa18454d9aee8ac7d61079dccfefc4cc247e5e4d9bead2899f91ce generator: "fe-fleet/md-twin@1.0" --- # Gibraltar Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/gibraltar/), [World Payments](https://payments.gi/jurisdictions/gibraltar/) Last updated 2026-11-03 · 10 categories · 38 claims · 64 sources in the cumulative register Download report (PDF) Expand all Gibraltar's data protection framework was amended by the Data Protection Regulations 2026, in force from midnight on 15 July 2026, made under section 13 of the Treaty on Gibraltar and the European Union Act 2026 and section 184 of the Data Protection Act 2004. Data collected 2026-10-24 · Data published 2026-11-03 Expert reviewed as at 24 Oct 2026 · peter-pink-howitt-ramparts Not fully checked this cycle: Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch (3 open gaps). Evidence re-verified: 2026-11-03 · Position last changed: 2026-11-03 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: Expert-reviewed · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=GIBRALTAR)[Build Report](/reports/?j=GIBRALTAR)[Compare](/compare/?j=GIBRALTAR) Framework posture Regulated (omnibus) 10 of 10 modules populated · Expert-reviewed Lead supervisory authority Gibraltar Regulatory Authority (GRA) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2026-Q4 GRA guidance on prediction-market operator KYC/AML data processing Module coverage & confidence 10 / 10 modules assessed 10 Confirmed · 0 Probable · 0 Uncertain 10 Categories 2 Red categories 57 Sub-modules 38 Claims 4 Tier-1 sources Traffic-light mix 1 green 7 amber 2 red (sums to 10 rendered categories; click to filter) 2 categories flagged red ## Jurisdiction brief Standing operating brief 259 words GI operates under a regulated (omnibus) supervised by Gibraltar Regulatory Authority (GRA) , with 10 regulatory modules assessed in the current cycle. - D1 · Regulator & Framework: Comprehensive statutory framework under the Data Protection Act 2004 and Gibraltar GDPR, enforced by the Gibraltar Regulatory Authority (GRA) as Information Commissioner, with post-Brexit abolition of routine controller registration/fee filings. - D2 · Lawful Processing: Framework is GDPR-aligned but Gibraltar-specific consent-threshold and pseudonymisation guidance is thin in the public record. - D3 · Data Subject Rights: Rights framework is GDPR-aligned and actively enforced (SAR failures investigated) but Gibraltar-specific procedural guidance on erasure/portability/deadlines was not located in this pass. - D4 · Controller & Processor: Strong enforcement record evidences the regime's teeth, but DPO-appointment thresholds and joint-controller-specific Gibraltar guidance were not located. All 10 module posture summaries - D1 · Regulator & Framework: Comprehensive statutory framework under the Data Protection Act 2004 and Gibraltar GDPR, enforced by the Gibraltar Regulatory Authority (GRA) as Information Commissioner, with post-Brexit abolition of routine controller registration/fee filings. - D2 · Lawful Processing: Framework is GDPR-aligned but Gibraltar-specific consent-threshold and pseudonymisation guidance is thin in the public record. - D3 · Data Subject Rights: Rights framework is GDPR-aligned and actively enforced (SAR failures investigated) but Gibraltar-specific procedural guidance on erasure/portability/deadlines was not located in this pass. - D4 · Controller & Processor: Strong enforcement record evidences the regime's teeth, but DPO-appointment thresholds and joint-controller-specific Gibraltar guidance were not located. - D5 · Cross-Border & Adequacy: Bidirectional UK–Gibraltar transfers flow freely by statute, and outbound Gibraltar-to-EEA transfers are permitted under Schedule 21 DPA 2004; however, inbound EEA-to-Gibraltar transfers continue to require Art. 46 EU GDPR safeguards (such as EU 2021 SCCs) pending formal European Commission adequacy under the UK–EU Gibraltar Treaty (political agreement reached 11 June 2025, final draft legal text published 2026). - D6 · Sectoral Watch: Several sector overlays are evidenced (health, telecoms, employment, education); financial-sector-specific DP overlay guidance was not independently confirmed in this pass. - D7 · AdTech & Marketing: Direct marketing sub-module is well evidenced; most other sub-modules rely on inferred alignment with EU ePrivacy norms rather than confirmed Gibraltar-specific sources. - D8 · AI, Biometrics & Automated: Almost no Gibraltar-specific guidance found on profiling, ADM transparency, AI risk assessment, biometrics or genetic data; only the state-surveillance carve-out is confirmed. - D9 · Children's Privacy: Coverage almost entirely absent for this module; only a general education-exemption reference was confirmed. - D10 · Enforcement & Redress: Enforcement powers and activity are well evidenced; redress mechanisms, regulator capacity data, and GI-specific recent developments are not confirmed. Key regulatory facts for Gibraltar Regulatory Dimension Gibraltar Standing Position Jurisdiction Gibraltar (GI) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 38 sourced findings) Regulator & Framework Comprehensive statutory framework under the Data Protection Act 2004 and Gibraltar GDPR, enforced by the Gibraltar Regulatory Authority (GRA) as Information Commissioner, with post-Brexit abolition of routine... Lawful Processing & Special Data Framework is GDPR-aligned but Gibraltar-specific consent-threshold and pseudonymisation guidance is thin in the public record. Data Subject Rights Rights framework is GDPR-aligned and actively enforced (SAR failures investigated) but Gibraltar-specific procedural guidance on erasure/portability/deadlines was not located in this pass. Controller/Processor Duties Strong enforcement record evidences the regime's teeth, but DPO-appointment thresholds and joint-controller-specific Gibraltar guidance were not located. Primary Instruments Cited Gibraltar Regulatory Authority, OneTrust DataGuidance, OneTrust DataGuidance, OneTrust DataGuidance, OneTrust DataGuidance Last Confirmed / Updated 2026-11-03 (64 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Gibraltar: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Confirmed▾ Comprehensive statutory framework under the Data Protection Act 2004 and Gibraltar GDPR, enforced by the Gibraltar Regulatory Authority (GRA) as Information Commissioner, with post-Brexit abolition of routine controller registration/fee filings. Primary framework Gibraltar GDPR (retained EU GDPR 2016/679) and Data Protection Act 2004 (as amended) Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection) Traffic-light rationale — Green Comprehensive statutory framework under the Data Protection Act 2004 and Gibraltar GDPR, enforced by the Gibraltar Regulatory Authority (GRA) as Information Commissioner, with post-Brexit abolition of routine controller registration/fee filings. #### Sub-modules (5) Gibraltar's data protection regime is governed by the Data Protection Act 2004 (DPA 2004, Act No. 2004-01, substantially restructured on 25 May 2018 and amended at post-Brexit transition on 1 January 2021 by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019), the retained Gibraltar General Data Protection Regulation (Gibraltar GDPR), and the Communications (Personal Data and Privacy) Regulations 2006 (CPDPR 2006, LN 2006/126, enacted under the Communications Act 2006). The Gibraltar Regulatory Authority (GRA), established under the Gibraltar Regulatory Authority Act 2000, is designated under s.129 DPA 2004 as the Information Commissioner and exercises independent supervisory, investigative, and enforcement functions across all six parts of the DPA 2004 (Part II general processing supplementing the Gibraltar GDPR; Part III law enforcement processing by competent authorities transposing Directive (EU) 2016/680; Part V Information Commissioner functions; Part VI enforcement and offences). Material and territorial scope mirror Art. 2 and Art. 3 GDPR: the Gibraltar GDPR applies to controllers and processors established in Gibraltar (Art. 3(1)) and extraterritorially to non-Gibraltar entities offering goods or services to, or monitoring the behaviour of, individuals in Gibraltar (Art. 3(2)), who must appoint a Gibraltar Representative under Art. 27 unless exempt. Following the 2018 GDPR reforms, Gibraltar abolished routine controller registration and annual data-protection fee filings; controllers instead maintain internal Art. 30 Records of Processing Activities (ROPA) and notify the GRA only when designating a Data Protection Officer (Art. 37(7)), reporting a personal data breach (Art. 33), or seeking Art. 36 prior consultation. Sources and claims (6) - Primary statutory record — Gibraltar abolished routine annual controller registration and fee filings in May 2018; controllers instead maintain internal Art. 30 ROPAs and notify the GRA when appointing a DPO (Art. 37(7)) or reporting a personal data breach (Art. 33). - Primary statutory record — The Gibraltar Regulatory Authority (GRA) is designated under s.129 of the Data Protection Act 2004 as the Information Commissioner and independent supervisory authority for the Gibraltar GDPR, DPA 2004, and Communications (Personal Data and Privacy) Regulations 2006. - [Gibraltar Regulatory Authority](https://www.gra.gi/data-protection) — The Gibraltar Regulatory Authority (GRA) is the supervisory authority responsible for enforcing the Data Protection Act 2004 and the Gibraltar GDPR, including issuing fines and guidance. - [OneTrust DataGuidance](https://www.dataguidance.com/notes/gibraltar-smsmms-marketing) — Following the end of the Brexit transition period, the applicable law in Gibraltar is no longer the EU GDPR but the Gibraltar GDPR, which superseded it on 1 January 2021 pursuant to Section 6 of the European Union (Withdrawal) Act 2019, alongside the Data Protection Act 2004 (as amended in 2019). - [Gibraltar Regulatory Authority](https://www.gra.gi/data-protection) — Material scope of the Gibraltar regime mirrors GDPR Article 2, covering wholly/partly automated processing and structured manual filing systems of personal data. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/gibraltar-navigating-brexit-and-data-protection) — Even after the end of the Brexit transition period, a Gibraltar-based controller or processor offering goods or services to, or monitoring the behaviour of, individuals in the EEA must continue to comply with the EU GDPR. ### Gibraltar: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Framework is GDPR-aligned but Gibraltar-specific consent-threshold and pseudonymisation guidance is thin in the public record. Primary framework Gibraltar GDPR Arts 6 & 9; Data Protection Act 2004 exemptions provisions Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection) Traffic-light rationale — Amber Framework is GDPR-aligned but Gibraltar-specific consent-threshold and pseudonymisation guidance is thin in the public record. #### Sub-modules (4) Processing of personal data in Gibraltar requires one of the six lawful bases in Art. 6(1)(a)–(f) Gibraltar GDPR (consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests supported by a three-stage Legitimate Interests Assessment). Note that the UK's Data (Use and Access) Act 2025 is an Act of the UK Parliament and does NOT extend to Gibraltar: Gibraltar GDPR continues to operate the unamended six Art. 6(1) bases without a separate 'recognised legitimate interests' annex. Consent under Art. 4(11) and Art. 7 Gibraltar GDPR must be freely given, specific, informed, unambiguous, and unbundled. Special category data under Art. 9 Gibraltar GDPR and criminal convictions/offences data under Art. 10 Gibraltar GDPR and s.15 DPA 2004 must satisfy a condition in Schedule 1 to the DPA 2004 (Part 1 employment, health, archiving, and research conditions; Part 2 substantial public interest conditions, including statutory functions, preventing/detecting unlawful acts, regulatory requirements across financial services and gaming, anti-money laundering, insurance, and safeguarding; Part 3 criminal convictions extensions), which generally require the controller to maintain an Appropriate Policy Document (APD) under Schedule 1 Part 4 explaining compliance with the Art. 5 principles and retention/erasure policies. Pseudonymised data remains personal data under Art. 4(5) Gibraltar GDPR, whereas irreversibly anonymised data passing the 'all means reasonably likely to be used' test falls outside statutory scope. Sources and claims (4) - Primary statutory record — Processing of special category data (Art. 9 Gibraltar GDPR) and criminal offence data (Art. 10) is supplemented by s.15 and Schedule 1 to the Data Protection Act 2004, which requires an Appropriate Policy Document (APD) under Schedule 1 Part 4 for most employment, regulatory, and substantial public interest conditions. - [Gibraltar Regulatory Authority](https://www.gra.gi/data-protection) — The Gibraltar GDPR retains the six lawful bases for processing set out in Article 6 of Regulation (EU) 2016/679. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-guidance-exemptions-data-protection-legislation) — GRA guidance outlines exemptions from the Data Protection Act 2004 and GDPR available for, among others, crime, law enforcement and public protection, journalism, research and archiving, and health, social work and education processing, and clarifies these cannot be routinely relied upon and must be justified case-by-case. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-guidance-gdpr-and-location-data) — GRA guidance on location data states that anonymisation is preferred and that consent is required where location data is not anonymised, encouraging transparency about anonymisation methodology. ### Gibraltar: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Rights framework is GDPR-aligned and actively enforced (SAR failures investigated) but Gibraltar-specific procedural guidance on erasure/portability/deadlines was not located in this pass. Primary framework Gibraltar GDPR Arts 12-22 Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection) Traffic-light rationale — Amber Rights framework is GDPR-aligned and actively enforced (SAR failures investigated) but Gibraltar-specific procedural guidance on erasure/portability/deadlines was not located in this pass. #### Sub-modules (5) Chapter III (Arts. 12–23) of the Gibraltar GDPR confers the full suite of data subject rights: transparent privacy notices (Arts. 13–14), subject access (Art. 15 DSAR), rectification (Art. 16), erasure / right to be forgotten (Art. 17), restriction of processing (Art. 18), notification of rectification/erasure/restriction (Art. 19), data portability in a structured, commonly used, machine-readable format where processing is automated and based on consent or contract (Art. 20), objection to public-task or legitimate-interests processing and an absolute right to object to direct marketing (Art. 21), and protection against solely automated decision-making including profiling (Art. 22). Under Art. 12(3) Gibraltar GDPR, controllers must respond without undue delay and within one calendar month of receipt, extendable by up to two further months for complex or numerous requests provided the data subject is notified of the extension and reasons within the initial month. Requests are free of charge unless 'manifestly unfounded or excessive' (Art. 12(5)). Statutory exemptions to Chapter III rights are set out in Schedules 2, 3, and 4 to the DPA 2004, covering crime and taxation, regulatory functions of the GFSC, GRA, and Gambling Division, legal professional privilege, judicial independence, journalism/academic/artistic expression, management forecasts, corporate finance, negotiations, confidential references, and health/social work/education records. Sources and claims (3) - Primary statutory record — Under Art. 12(3) Gibraltar GDPR, controllers must respond to data subject rights requests within one calendar month (extendable by up to two further months for complex or numerous requests), subject to statutory exemptions in Schedules 2–4 to the Data Protection Act 2004. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-reports-enforcement-activity) — GRA's published investigations and enforcement report addresses cases involving failure to respond to subject access requests, among other compliance failures under GDPR and the DPA 2004. - [Gibraltar Regulatory Authority](https://www.gra.gi/data-protection) — The Gibraltar GDPR retains the GDPR Article 12(3) standard one-month response deadline for data subject requests, extendable by two further months for complex/numerous requests. ### Gibraltar: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Strong enforcement record evidences the regime's teeth, but DPO-appointment thresholds and joint-controller-specific Gibraltar guidance were not located. Primary framework Data Protection Act 2004 (as amended) Part III; Gibraltar GDPR Arts 24-39 Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection) Traffic-light rationale — Amber Strong enforcement record evidences the regime's teeth, but DPO-appointment thresholds and joint-controller-specific Gibraltar guidance were not located. #### Sub-modules (7) Chapter IV (Arts. 24–43) of the Gibraltar GDPR imposes identical accountability, governance, and security obligations to the EU and UK GDPR baselines: controllers must implement Data Protection by Design and by Default (Art. 25), execute binding written processor agreements containing all Art. 28(3) clauses, maintain written electronic Records of Processing Activities (Art. 30 ROPA, with the <250-employee exemption under Art. 30(5) disapplied for non-occasional, special-category, or risk-bearing processing), transparently allocate responsibilities in Joint Controller arrangements (Art. 26), and implement risk-proportionate technical and organisational security measures (Art. 32). Designation of a Data Protection Officer (Arts. 37–39) is mandatory for public authorities, controllers/processors whose core activities involve regular and systematic monitoring on a large scale, or large-scale processing of Art. 9/10 data — a threshold routinely triggered across Gibraltar's licensed remote gambling (B2C/B2B), distributed ledger technology (DLT), e-money, banking, and insurance sectors — with DPO details notified to the GRA under Art. 37(7). Data Protection Impact Assessments (Art. 35 DPIA) are mandatory prior to high-risk processing (including large-scale player behavioural/affordability profiling, biometric onboarding, AI deployment, and systematic CCTV/workplace monitoring per GRA DPIA guidance). Personal data breaches must be notified to the GRA within 72 hours under Art. 33 unless unlikely to result in a risk, and communicated to affected individuals without undue delay under Art. 34 where high risk is likely; telecoms/ISP providers face an immediate 24-hour notification obligation under Reg. 5A of the Communications (Personal Data and Privacy) Regulations 2006. Sources and claims (6) - Primary statutory record — Controllers must notify personal data breaches to the GRA within 72 hours under Art. 33 Gibraltar GDPR unless unlikely to result in a risk, while public electronic communications providers must notify the GRA within 24 hours under Reg. 5A of the Communications (Personal Data and Privacy) Regulations 2006. - [OneTrust DataGuidance](https://www.dataguidance.com/notes/gibraltar-data-protection-impact-assessment) — Sections 73 and 74 of the Data Protection Act 2004 (as amended in 2019), read with recitals 4, 75, 76, 84, 90, 92 and Article 35 of the GDPR, impose data protection impact assessment obligations in Gibraltar. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-fines-royal-gibraltar-police-%C2%A310000) — The GRA's 18 April 2022 decision fined the Royal Gibraltar Police £10,000 partly for failures relating to records of processing activities, in violation of Article 30 GDPR and corresponding DPA 2004 sections. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-issues-data-security-guidance-under-gdpr) — GRA's 19 March 2020 guidance emphasises that organisations are accountable for establishing appropriate security measures and must adopt a risk-based approach, highlighting certification, third-party audits, breach management and multi-factor authentication. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-fines-royal-gibraltar-police-%C2%A310000) — The Royal Gibraltar Police was fined £10,000 for, among other violations, breaching Sections 65(1)-(2), 70, 75 and 77(1)-(2) of the DPA 2004 and Articles 24(1)-(2), 30, 32 and 34(1)-(2) GDPR concerning breach communication and security, having notified the GRA and data subjects only after delay. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-fines-royal-gibraltar-police-%C2%A310000) — The GRA's 2022 fine decision cited storage-limitation failures under Section 48(1)-(2) DPA 2004 and Article 5(1)(e) GDPR against the Royal Gibraltar Police. ### Gibraltar: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Bidirectional UK–Gibraltar transfers flow freely by statute, and outbound Gibraltar-to-EEA transfers are permitted under Schedule 21 DPA 2004; however, inbound EEA-to-Gibraltar transfers continue to require Art. 46 EU GDPR safeguards (such as EU 2021 SCCs) pending formal European Commission adequacy under the UK–EU Gibraltar Treaty (political agreement reached 11 June 2025, final draft legal text published 2026). Primary framework Gibraltar GDPR Arts 44-49; UK Data Protection (Adequacy) framework Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection) Traffic-light rationale — Amber Bidirectional UK–Gibraltar transfers flow freely by statute, and outbound Gibraltar-to-EEA transfers are permitted under Schedule 21 DPA 2004; however, inbound EEA-to-Gibraltar transfers continue to require Art. 46 EU GDPR safeguards (such as EU 2021 SCCs) pending formal European Commission adequacy under the UK–EU Gibraltar Treaty (political agreement reached 11 June 2025, final draft legal text published 2026). #### Sub-modules (6) Gibraltar's cross-border transfer profile is asymmetrically structured across the UK and the EEA. First, between the United Kingdom and Gibraltar, personal data flows unrestricted in both directions: the UK grants statutory adequacy to Gibraltar under Schedule 21 para. 4(2)(b) to the UK Data Protection Act 2018 (retained via the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019), and Gibraltar reciprocally designates the UK, EEA Member States, and EU-adequate third countries as adequate for outbound transfers from Gibraltar under Chapter V Gibraltar GDPR and Schedule 21 to the Gibraltar DPA 2004. Second, for inbound transfers FROM the EEA TO Gibraltar, the European Commission's UK adequacy decisions (28 June 2021 and the 19 December 2025 renewals under Implementing Decisions (EU) 2025/2545 and 2025/2546) explicitly exclude Gibraltar from their territorial scope. Consequently, EEA controllers/processors transferring personal data to Gibraltar must currently rely on an Art. 46 EU GDPR transfer mechanism — primarily the European Commission's 2021 Standard Contractual Clauses (Decision (EU) 2021/914) or EU Binding Corporate Rules — supported by a Transfer Impact Assessment, unless an Art. 49 derogation applies. On 11 June 2025, the UK, European Commission, Spain, and Gibraltar reached political agreement on the UK–EU Treaty in respect of Gibraltar (with the final draft legal text published in 2026), which provides the treaty pathway for EEA data-flow alignment and an EU adequacy bridge upon ratification. For outbound transfers from Gibraltar to non-adequate third countries (e.g., US non-DPF recipients, India, APAC), Gibraltar exporters rely on Art. 46 Gibraltar GDPR appropriate safeguards (adapted EU SCCs / UK IDTA framework per GRA guidance or approved BCRs) plus a Transfer Risk Assessment. Sources and claims (4) - Primary statutory record — Personal data flows freely between the UK and Gibraltar under UK DPA 2018 Schedule 21 para. 4(2)(b) and Gibraltar DPA 2004 Schedule 21, while inbound EEA-to-Gibraltar transfers require EU Art. 46 safeguards (such as the 2021 EU SCCs) pending formal EU adequacy under the UK–EU Gibraltar Treaty. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/gibraltar-navigating-brexit-and-data-protection) — In the absence of an EU adequacy decision for Gibraltar, GRA's Transfers Guidance directs that EEA controllers transferring to Gibraltar should rely on Article 46 GDPR safeguards, including Standard Contractual Clauses and Binding Corporate Rules. - [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/adequacy-regulations/is-the-restricted-transfer-covered-by-adequacy-regulations/) — The UK ICO lists Gibraltar among the countries and territories covered by full UK adequacy regulations, permitting restricted transfers from the UK to Gibraltar without additional safeguards; Gibraltar-based organisations may also rely on the UK Extension to the EU-US Data Privacy Framework for transfers to certain self-certified US businesses. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/gibraltar-navigating-brexit-and-data-protection) — As of the guidance reviewed, the Government of Gibraltar intended to seek an EU adequacy decision to ensure continuing free flow of data from the EEA to Gibraltar, but no such decision had been finalised at that time. ### Gibraltar: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Several sector overlays are evidenced (health, telecoms, employment, education); financial-sector-specific DP overlay guidance was not independently confirmed in this pass. Primary framework Communications (Personal Data and Privacy) Regulations 2006; Data Protection Act 2004 exemptions provisions Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection) Traffic-light rationale — Amber Several sector overlays are evidenced (health, telecoms, employment, education); financial-sector-specific DP overlay guidance was not independently confirmed in this pass. #### Sub-modules (7) Sectoral data protection governance in Gibraltar is tightly integrated with its primary regulated industries: financial services, distributed ledger technology (DLT), remote gambling, electronic communications, health, and employment. Financial services, insurance, e-money, payment services, and DLT providers regulated by the Gibraltar Financial Services Commission (GFSC) under the Financial Services Act 2019 (Act 2019-26) and the Financial Services (Distributed Ledger Technology Providers) Regulations 2020 must reconcile Gibraltar GDPR data minimisation and erasure duties with mandatory customer due diligence (CDD), transaction monitoring, Travel Rule, and 5-year statutory record retention under the Proceeds of Crime Act 2015 (POCA 2015, s.25), relying on Art. 6(1)(c) legal obligation and DPA 2004 Schedule 1 Part 2 AML/regulatory conditions. Remote gambling operators licensed under the Gambling Act 2005 (and the incoming Gambling Act reform framework) conduct extensive AML, safer-gambling behavioural monitoring, and affordability profiling under licence conditions supervised by the Gambling Commissioner alongside the GRA. Electronic communications and ePrivacy are governed by the Communications (Personal Data and Privacy) Regulations 2006 (LN 2006/126). Public healthcare is delivered by the Gibraltar Health Authority (GHA) under the Medical (Gibraltar Health Authority) Act 1987 alongside private clinics under Art. 9(2)(h) and DPA 2004 Schedule 1 Part 1 para. 2. Employment processing is governed by the Employment Act, the Bullying at Work Act 2014, and GRA workplace monitoring guidance. Sources and claims (6) - Primary statutory record — GFSC-regulated financial services and DLT providers under the Financial Services Act 2019 and remote gaming operators under the Gambling Act 2005 must retain CDD and transaction records for 5 years under s.25 of the Proceeds of Crime Act 2015, engaging the Art. 17(3)(b) legal-obligation exception to erasure. - [Gibraltar Regulatory Authority](https://www.gra.gi/data-protection) — Gibraltar's finance and gaming industries, supervised separately by the Gibraltar Financial Services Commission, plausibly create sector-specific data-handling obligations that intersect with general DP duties, though a dedicated overlay instrument was not confirmed. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-guidance-gdpr-and-location-data) — GRA's guidance on contact tracing and location data identifies the Gibraltar Health Authority as controller, requiring robust security, data minimisation, transparency, Data Protection by Design and Default, and a DPIA for contact-tracing apps. - [OneTrust DataGuidance](https://www.dataguidance.com/notes/gibraltar-smsmms-marketing) — The Communications (Personal Data and Privacy) Regulations 2006 apply to SMS/MMS and electronic marketing in Gibraltar in addition to the Gibraltar GDPR and Data Protection Act 2004. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-fines-royal-gibraltar-police-%C2%A310000) — The GRA's investigation into the Royal Gibraltar Police confirmed data protection violations relating to both law-enforcement and employment-purpose processing of personal data. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-guidance-exemptions-data-protection-legislation) — GRA's exemptions guidance outlines exemptions available under the DPA 2004 and GDPR for, among other things, health, social work, and education processing. ### Gibraltar: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Direct marketing sub-module is well evidenced; most other sub-modules rely on inferred alignment with EU ePrivacy norms rather than confirmed Gibraltar-specific sources. Primary framework Communications (Personal Data and Privacy) Regulations 2006 Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection) Traffic-light rationale — Amber Direct marketing sub-module is well evidenced; most other sub-modules rely on inferred alignment with EU ePrivacy norms rather than confirmed Gibraltar-specific sources. #### Sub-modules (6) Electronic marketing, cookies, and online tracking in Gibraltar are governed by the Communications (Personal Data and Privacy) Regulations 2006 (CPDPR 2006, LN 2006/126) read alongside the Gibraltar GDPR. Under Reg. 6 CPDPR 2006, storing information or gaining access to information stored in the terminal equipment of a subscriber or user (cookies, SDKs, tracking pixels, device fingerprinting) is permitted only where the user has been provided with clear and comprehensive information about the purposes of the storage/access and given consent (to the Gibraltar GDPR Art. 4(11) / Art. 7 affirmative opt-in standard), except for technical storage/access for the sole purpose of carrying out the transmission of a communication or where strictly necessary to provide an information society service explicitly requested by the user. Note that the UK's DUAA 2025 Schedule 12 analytics/preference cookie exemptions do NOT apply in Gibraltar: non-essential analytics and advertising cookies continue to require prior opt-in consent. Direct marketing by electronic mail (email, SMS, push/in-app messages) to individual subscribers requires prior opt-in consent under Reg. 23 CPDPR 2006 unless the commercial 'soft opt-in' under Reg. 23(3) applies (contact details obtained in the course of a sale or negotiations for the sale of a product or service, marketing the controller's own similar products/services, with a free opt-out offered at collection and in every subsequent communication). Unsolicited automated calling systems require prior opt-in (Reg. 20), and live unsolicited marketing calls must respect subscriber opt-out objections and directory preference markings (Reg. 22). Every marketing communication must identify the sender and provide a valid opt-out address (Reg. 24), and Art. 21(2)–(3) Gibraltar GDPR confers an absolute right to object to direct marketing and profiling for direct marketing at any time. Sources and claims (2) - Primary statutory record — Under Reg. 6 and Reg. 23 of the Communications (Personal Data and Privacy) Regulations 2006 (LN 2006/126), non-essential cookies and electronic mail marketing to individual subscribers require prior Gibraltar GDPR-standard opt-in consent unless the Reg. 23(3) existing-customer soft opt-in applies. - [OneTrust DataGuidance](https://www.dataguidance.com/notes/gibraltar-smsmms-marketing) — The Communications (Personal Data and Privacy) Regulations 2006 impose consent requirements applicable to SMS/MMS marketing in Gibraltar, operating alongside the Gibraltar GDPR and Data Protection Act 2004. ### Gibraltar: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Confirmed▾ Almost no Gibraltar-specific guidance found on profiling, ADM transparency, AI risk assessment, biometrics or genetic data; only the state-surveillance carve-out is confirmed. Primary framework Gibraltar GDPR Arts 9 & 22 Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection) Traffic-light rationale — Red Almost no Gibraltar-specific guidance found on profiling, ADM transparency, AI risk assessment, biometrics or genetic data; only the state-surveillance carve-out is confirmed. #### Sub-modules (6) Gibraltar retains the unamended Art. 22 Gibraltar GDPR prohibition on solely automated decision-making, including profiling, that produces legal effects concerning a data subject or similarly significantly affects them (the UK's DUAA 2025 Arts. 22A–22D relaxation does NOT apply in Gibraltar). Under Art. 22(2) Gibraltar GDPR and s.19 DPA 2004, solely automated significant decisions are permitted only where (a) necessary for entering into or performing a contract between the data subject and controller, (b) authorised by Gibraltar law laying down suitable safeguards (subject to s.19 DPA 2004 written notification and 21-day reconsideration rights), or (c) based on the data subject's explicit consent, and in cases (a) and (c) the controller must implement suitable safeguards including the right to obtain human intervention, express the data subject's point of view, and contest the decision (Art. 22(3)). Solely automated decisions based on Art. 9 special category data are prohibited under Art. 22(4) unless explicit consent or substantial public interest (Art. 9(2)(a) or (g)) applies. This framework directly governs automated AML/fraud blocking, affordability scoring, and responsible-gambling interventions across Gibraltar's licensed gaming and fintech sectors: where a system automatically suspends an account or refuses service without meaningful human review, Art. 22(3) / s.19 DPA 2004 safeguards and Arts. 13(2)(f)/14(2)(g)/15(1)(h) logic-transparency disclosures apply. Biometric data processed for unique identification (e.g., facial recognition KYC liveness checks or workplace biometric access) is Art. 9(1) special category data requiring explicit consent or a Schedule 1 DPA 2004 condition plus an Art. 35 DPIA, while CCTV and video surveillance are governed by the GRA's dedicated CCTV Guidance. Sources and claims (2) - Primary statutory record — Art. 22 Gibraltar GDPR and s.19 of the Data Protection Act 2004 prohibit solely automated decision-making (including profiling) producing legal or similarly significant effects unless necessary for contract, authorised by Gibraltar law with a 21-day human reconsideration right, or based on explicit consent. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-guidance-exemptions-data-protection-legislation) — GRA guidance confirms exemptions from the Data Protection Act 2004 and GDPR for crime, law enforcement and public protection purposes, which cannot be routinely relied upon and require case-by-case justification and documentation under the accountability principle. ### Gibraltar: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Confirmed▾ Coverage almost entirely absent for this module; only a general education-exemption reference was confirmed. Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection) Traffic-light rationale — Red Coverage almost entirely absent for this module; only a general education-exemption reference was confirmed. #### Sub-modules (5) No Gibraltar-specific age-of-consent, parental-consent mechanism, minor-profiling ban, or dependent-adults provision was independently located in this pass, beyond the general education-sector exemption referenced in GRA's exemptions guidance. Sources and claims (2) - Primary statutory record — Section 14 of the Gibraltar Data Protection Act 2004 sets the age of digital consent for Information Society Services under Art. 8(1) Gibraltar GDPR at 13 years, requiring parental responsibility holder authorisation below age 13 (except for preventive or counselling services under s.14(2)). - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-guidance-exemptions-data-protection-legislation) — GRA's exemptions guidance identifies education as one of the sectors for which case-by-case processing exemptions from the DPA 2004/GDPR may apply. ### Gibraltar: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Confirmed▾ Enforcement powers and activity are well evidenced; redress mechanisms, regulator capacity data, and GI-specific recent developments are not confirmed. Primary framework Data Protection Act 2004 Part IV (enforcement); Gibraltar GDPR Arts 83-84 (as retained) Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection) Traffic-light rationale — Amber Enforcement powers and activity are well evidenced; redress mechanisms, regulator capacity data, and GI-specific recent developments are not confirmed. #### Sub-modules (6) Part VI (ss.135–183) of the Data Protection Act 2004 and Art. 83 Gibraltar GDPR vest the GRA (as Information Commissioner) with comprehensive investigative, corrective, and fining powers: Information Notices (s.136), Assessment Notices including compulsory inspection and audit powers (s.140), Enforcement Notices requiring specific compliance steps or ordering suspension of processing/transfers (s.142), and Penalty Notices (s.147). Administrative fine ceilings under Art. 83 Gibraltar GDPR and s.149 DPA 2004 mirror the GDPR two-tier structure converted into Pound Sterling: up to £8,700,000 or 2% of total worldwide annual turnover (standard tier, Art. 83(4)) and up to £17,500,000 or 4% of total worldwide annual turnover (higher tier, Art. 83(5)–(6)). In addition, the DPA 2004 creates criminal offences for unlawfully obtaining, disclosing, or retaining personal data without the controller's consent (s.162), re-identifying de-identified personal data (s.163), altering/concealing records with intent to prevent DSAR disclosure (s.165), enforcing unlawful forced subject access requests as a condition of employment/service (s.176), and obstructing or making false statements to the Commissioner (Sch. 15). Under s.154 DPA 2004, appeals against GRA Information, Assessment, Enforcement, or Penalty Notices lie to the Magistrates' Court (and onward to the Supreme Court of Gibraltar). Data subjects have a direct statutory right to lodge complaints with the GRA (Art. 77 / s.157 DPA 2004), seek judicial compliance orders in the Supreme Court of Gibraltar (Art. 79 / s.159 DPA 2004), claim compensation for material and non-material damage (including distress) under Art. 82 Gibraltar GDPR and s.160 DPA 2004, and mandate non-profit representative bodies on an opt-in basis under Art. 80(1) Gibraltar GDPR and s.178 DPA 2004. Sources and claims (3) - Primary statutory record — Under Art. 83 Gibraltar GDPR and s.149 of the Data Protection Act 2004, the GRA may impose administrative Penalty Notices up to £8.7 million or 2% of worldwide annual turnover (standard tier) and £17.5 million or 4% of worldwide annual turnover (higher tier), alongside criminal offences under ss.162–165 and s.176 and private compensation claims (including distress) under s.160 DPA 2004. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-fines-royal-gibraltar-police-%C2%A35000) — The GRA fined the Royal Gibraltar Police £5,000 in August 2020 for unlawful disclosure of personal data, and £10,000 in April 2022 for multiple further breaches of the DPA 2004 and GDPR, demonstrating active use of its investigatory and fining powers. - [OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-reports-enforcement-activity) — GRA published, on 2 June 2020, reports on investigations and enforcement covering deletion of personal data, unlawful disclosure to third parties, unlawful processing, failure to respond to subject access requests, unlawful CCTV installation, and unsolicited email marketing, alongside a breach-notification report on unlawful CCTV footage disclosure. ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties