Gibraltar: Lawful Processing & Special Data

Processing of personal data in Gibraltar requires one of the six lawful bases in Art. 6(1)(a)–(f) Gibraltar GDPR (consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests supported by a three-stage Legitimate Interests Assessment). Note that the UK's Data (Use and Access) Act 2025 is an Act of the UK Parliament and does NOT extend to Gibraltar: Gibraltar GDPR continues to operate the unamended six Art. 6(1) bases without a separate 'recognised legitimate interests' annex. Consent under Art. 4(11) and Art. 7 Gibraltar GDPR must be freely given, specific, informed, unambiguous, and unbundled. Special category data under Art. 9 Gibraltar GDPR and criminal convictions/offences data under Art. 10 Gibraltar GDPR and s.15 DPA 2004 must satisfy a condition in Schedule 1 to the DPA 2004 (Part 1 employment, health, archiving, and research conditions; Part 2 substantial public interest conditions, including statutory functions, preventing/detecting unlawful acts, regulatory requirements across financial services and gaming, anti-money laundering, insurance, and safeguarding; Part 3 criminal convictions extensions), which generally require the controller to maintain an Appropriate Policy Document (APD) under Schedule 1 Part 4 explaining compliance with the Art. 5 principles and retention/erasure policies. Pseudonymised data remains personal data under Art. 4(5) Gibraltar GDPR, whereas irreversibly anonymised data passing the 'all means reasonably likely to be used' test falls outside statutory scope.