---
title: "Gibraltar — Lawful Processing & Special Data | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/gibraltar/lawful-processing-and-special-data/
source_html: /jurisdictions/gibraltar/lawful-processing-and-special-data/index.html
description: "Gibraltar — Lawful Processing & Special Data (Amber, 4 sub-modules, 4 claims): Framework is GDPR-aligned but Gibraltar-specific consent-threshold and pseudonymisation guidance is thin in the public record."
generated_at: 2026-10-25T04:46:50Z
content_sha256: e83c43c863efbf80ca84b7a3e443dea0f18b14e9563b504eef0aa13e62991dfc
generator: "fe-fleet/md-twin@1.0"
---
# Gibraltar — Lawful Processing & Special Data | Data Protection Monitor

### D2Lawful Processing & Special Data4 sub-modules4 claimsAmber▾#

Framework is GDPR-aligned but Gibraltar-specific consent-threshold and pseudonymisation guidance is thin in the public record.

Primary framework Gibraltar GDPR Arts 6 & 9; Data Protection Act 2004 exemptions provisions

Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection)

Traffic-light rationale — Amber Framework is GDPR-aligned but Gibraltar-specific consent-threshold and pseudonymisation guidance is thin in the public record.

#### Sub-modules (4)

Category narrative 220 words

Processing of personal data in Gibraltar requires one of the six lawful bases in Art. 6(1)(a)–(f) Gibraltar GDPR (consent, contract necessity, legal obligation, vital interests, public task, or legitimate interests supported by a three-stage Legitimate Interests Assessment). Note that the UK's Data (Use and Access) Act 2025 is an Act of the UK Parliament and does NOT extend to Gibraltar: Gibraltar GDPR continues to operate the unamended six Art. 6(1) bases without a separate 'recognised legitimate interests' annex. Consent under Art. 4(11) and Art. 7 Gibraltar GDPR must be freely given, specific, informed, unambiguous, and unbundled. Special category data under Art. 9 Gibraltar GDPR and criminal convictions/offences data under Art. 10 Gibraltar GDPR and s.15 DPA 2004 must satisfy a condition in Schedule 1 to the DPA 2004 (Part 1 employment, health, archiving, and research conditions; Part 2 substantial public interest conditions, including statutory functions, preventing/detecting unlawful acts, regulatory requirements across financial services and gaming, anti-money laundering, insurance, and safeguarding; Part 3 criminal convictions extensions), which generally require the controller to maintain an Appropriate Policy Document (APD) under Schedule 1 Part 4 explaining compliance with the Art. 5 principles and retention/erasure policies. Pseudonymised data remains personal data under Art. 4(5) Gibraltar GDPR, whereas irreversibly anonymised data passing the 'all means reasonably likely to be used' test falls outside statutory scope.

Evidence 4

Sources and claims (4)
- Confirmedunavailable — Processing of special category data (Art. 9 Gibraltar GDPR) and criminal offence data (Art. 10) is supplemented by s.15 and Schedule 1 to the Data Protection Act 2004, which requires an Appropriate Policy Document (APD) under Schedule 1 Part 4 for most employment, regulatory, and substantial public interest conditions.
- Probable[Gibraltar Regulatory Authority](https://www.gra.gi/data-protection) — The Gibraltar GDPR retains the six lawful bases for processing set out in Article 6 of Regulation (EU) 2016/679.observed 2026-08-05
- Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-guidance-exemptions-data-protection-legislation) — GRA guidance outlines exemptions from the Data Protection Act 2004 and GDPR available for, among others, crime, law enforcement and public protection, journalism, research and archiving, and health, social work and education processing, and clarifies these cannot be routinely relied upon and must be justified case-by-case.observed 2026-08-05
- Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/news/gibraltar-gra-publishes-guidance-gdpr-and-location-data) — GRA guidance on location data states that anonymisation is preferred and that consent is required where location data is not anonymised, encouraging transparency about anonymisation methodology.observed 2026-08-05