---
title: "Gibraltar — Regulator & Framework | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/gibraltar/regulator-and-framework/
source_html: /jurisdictions/gibraltar/regulator-and-framework/index.html
description: "Gibraltar — Regulator & Framework (Green, 5 sub-modules, 6 claims): Comprehensive statutory framework under the Data Protection Act 2004 and Gibraltar GDPR, enforced by the Gibraltar Regulatory Authority (GRA) as Information Commissioner, w"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 0f6d93aec86b370576f99adc8eb4465d2ec51f1593a772ffea673b07f822a539
generator: "fe-fleet/md-twin@1.0"
---
# Gibraltar — Regulator & Framework | Data Protection Monitor

### D1Regulator & Framework5 sub-modules6 claimsGreen▾#

Comprehensive statutory framework under the Data Protection Act 2004 and Gibraltar GDPR, enforced by the Gibraltar Regulatory Authority (GRA) as Information Commissioner, with post-Brexit abolition of routine controller registration/fee filings.

Primary framework Gibraltar GDPR (retained EU GDPR 2016/679) and Data Protection Act 2004 (as amended)

Supervisory authority [Gibraltar Regulatory Authority (GRA)](https://www.gra.gi/data-protection)

Traffic-light rationale — Green Comprehensive statutory framework under the Data Protection Act 2004 and Gibraltar GDPR, enforced by the Gibraltar Regulatory Authority (GRA) as Information Commissioner, with post-Brexit abolition of routine controller registration/fee filings.

#### Sub-modules (5)

Category narrative 250 words

Gibraltar's data protection regime is governed by the Data Protection Act 2004 (DPA 2004, Act No. 2004-01, substantially restructured on 25 May 2018 and amended at post-Brexit transition on 1 January 2021 by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019), the retained Gibraltar General Data Protection Regulation (Gibraltar GDPR), and the Communications (Personal Data and Privacy) Regulations 2006 (CPDPR 2006, LN 2006/126, enacted under the Communications Act 2006). The Gibraltar Regulatory Authority (GRA), established under the Gibraltar Regulatory Authority Act 2000, is designated under s.129 DPA 2004 as the Information Commissioner and exercises independent supervisory, investigative, and enforcement functions across all six parts of the DPA 2004 (Part II general processing supplementing the Gibraltar GDPR; Part III law enforcement processing by competent authorities transposing Directive (EU) 2016/680; Part V Information Commissioner functions; Part VI enforcement and offences). Material and territorial scope mirror Art. 2 and Art. 3 GDPR: the Gibraltar GDPR applies to controllers and processors established in Gibraltar (Art. 3(1)) and extraterritorially to non-Gibraltar entities offering goods or services to, or monitoring the behaviour of, individuals in Gibraltar (Art. 3(2)), who must appoint a Gibraltar Representative under Art. 27 unless exempt. Following the 2018 GDPR reforms, Gibraltar abolished routine controller registration and annual data-protection fee filings; controllers instead maintain internal Art. 30 Records of Processing Activities (ROPA) and notify the GRA only when designating a Data Protection Officer (Art. 37(7)), reporting a personal data breach (Art. 33), or seeking Art. 36 prior consultation.

Evidence 6

Sources and claims (6)
- Confirmedunavailable — Gibraltar abolished routine annual controller registration and fee filings in May 2018; controllers instead maintain internal Art. 30 ROPAs and notify the GRA when appointing a DPO (Art. 37(7)) or reporting a personal data breach (Art. 33).
- Confirmedunavailable — The Gibraltar Regulatory Authority (GRA) is designated under s.129 of the Data Protection Act 2004 as the Information Commissioner and independent supervisory authority for the Gibraltar GDPR, DPA 2004, and Communications (Personal Data and Privacy) Regulations 2006.
- Confirmed[Gibraltar Regulatory Authority](https://www.gra.gi/data-protection) — The Gibraltar Regulatory Authority (GRA) is the supervisory authority responsible for enforcing the Data Protection Act 2004 and the Gibraltar GDPR, including issuing fines and guidance.observed 2026-08-05
- Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/notes/gibraltar-smsmms-marketing) — Following the end of the Brexit transition period, the applicable law in Gibraltar is no longer the EU GDPR but the Gibraltar GDPR, which superseded it on 1 January 2021 pursuant to Section 6 of the European Union (Withdrawal) Act 2019, alongside the Data Protection Act 2004 (as amended in 2019).observed 2026-08-05
- Probable[Gibraltar Regulatory Authority](https://www.gra.gi/data-protection) — Material scope of the Gibraltar regime mirrors GDPR Article 2, covering wholly/partly automated processing and structured manual filing systems of personal data.observed 2026-08-05
- Confirmed[OneTrust DataGuidance](https://www.dataguidance.com/opinion/gibraltar-navigating-brexit-and-data-protection) — Even after the end of the Brexit transition period, a Gibraltar-based controller or processor offering goods or services to, or monitoring the behaviour of, individuals in the EEA must continue to comply with the EU GDPR.observed 2026-08-05