Gibraltar: Regulator & Framework

Gibraltar's data protection regime is governed by the Data Protection Act 2004 (DPA 2004, Act No. 2004-01, substantially restructured on 25 May 2018 and amended at post-Brexit transition on 1 January 2021 by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019), the retained Gibraltar General Data Protection Regulation (Gibraltar GDPR), and the Communications (Personal Data and Privacy) Regulations 2006 (CPDPR 2006, LN 2006/126, enacted under the Communications Act 2006). The Gibraltar Regulatory Authority (GRA), established under the Gibraltar Regulatory Authority Act 2000, is designated under s.129 DPA 2004 as the Information Commissioner and exercises independent supervisory, investigative, and enforcement functions across all six parts of the DPA 2004 (Part II general processing supplementing the Gibraltar GDPR; Part III law enforcement processing by competent authorities transposing Directive (EU) 2016/680; Part V Information Commissioner functions; Part VI enforcement and offences). Material and territorial scope mirror Art. 2 and Art. 3 GDPR: the Gibraltar GDPR applies to controllers and processors established in Gibraltar (Art. 3(1)) and extraterritorially to non-Gibraltar entities offering goods or services to, or monitoring the behaviour of, individuals in Gibraltar (Art. 3(2)), who must appoint a Gibraltar Representative under Art. 27 unless exempt. Following the 2018 GDPR reforms, Gibraltar abolished routine controller registration and annual data-protection fee filings; controllers instead maintain internal Art. 30 Records of Processing Activities (ROPA) and notify the GRA only when designating a Data Protection Officer (Art. 37(7)), reporting a personal data breach (Art. 33), or seeking Art. 36 prior consultation.