Data Protection Monitor
Global Privacy & Data Protection Intelligence

Gibraltar (GI) · Module Detail

Gibraltar: Sectoral Watch

← Full Gibraltar overview Build report with Gibraltar Request deeper dive

#

Several sector overlays are evidenced (health, telecoms, employment, education); financial-sector-specific DP overlay guidance was not independently confirmed in this pass.

Primary frameworkCommunications (Personal Data and Privacy) Regulations 2006; Data Protection Act 2004 exemptions provisions
Supervisory authorityGibraltar Regulatory Authority (GRA)
Traffic-light rationale — AmberSeveral sector overlays are evidenced (health, telecoms, employment, education); financial-sector-specific DP overlay guidance was not independently confirmed in this pass.

Sub-modules (7)

Category narrative216 words

Sectoral data protection governance in Gibraltar is tightly integrated with its primary regulated industries: financial services, distributed ledger technology (DLT), remote gambling, electronic communications, health, and employment. Financial services, insurance, e-money, payment services, and DLT providers regulated by the Gibraltar Financial Services Commission (GFSC) under the Financial Services Act 2019 (Act 2019-26) and the Financial Services (Distributed Ledger Technology Providers) Regulations 2020 must reconcile Gibraltar GDPR data minimisation and erasure duties with mandatory customer due diligence (CDD), transaction monitoring, Travel Rule, and 5-year statutory record retention under the Proceeds of Crime Act 2015 (POCA 2015, s.25), relying on Art. 6(1)(c) legal obligation and DPA 2004 Schedule 1 Part 2 AML/regulatory conditions. Remote gambling operators licensed under the Gambling Act 2005 (and the incoming Gambling Act reform framework) conduct extensive AML, safer-gambling behavioural monitoring, and affordability profiling under licence conditions supervised by the Gambling Commissioner alongside the GRA. Electronic communications and ePrivacy are governed by the Communications (Personal Data and Privacy) Regulations 2006 (LN 2006/126). Public healthcare is delivered by the Gibraltar Health Authority (GHA) under the Medical (Gibraltar Health Authority) Act 1987 alongside private clinics under Art. 9(2)(h) and DPA 2004 Schedule 1 Part 1 para. 2. Employment processing is governed by the Employment Act, the Bullying at Work Act 2014, and GRA workplace monitoring guidance.

Sources and claims (6)
  1. Confirmedunavailable — GFSC-regulated financial services and DLT providers under the Financial Services Act 2019 and remote gaming operators under the Gambling Act 2005 must retain CDD and transaction records for 5 years under s.25 of the Proceeds of Crime Act 2015, engaging the Art. 17(3)(b) legal-obligation exception to erasure.
  2. SpeculativeGibraltar Regulatory Authority — Gibraltar's finance and gaming industries, supervised separately by the Gibraltar Financial Services Commission, plausibly create sector-specific data-handling obligations that intersect with general DP duties, though a dedicated overlay instrument was not confirmed.observed
  3. ConfirmedOneTrust DataGuidance — GRA's guidance on contact tracing and location data identifies the Gibraltar Health Authority as controller, requiring robust security, data minimisation, transparency, Data Protection by Design and Default, and a DPIA for contact-tracing apps.observed
  4. ConfirmedOneTrust DataGuidance — The Communications (Personal Data and Privacy) Regulations 2006 apply to SMS/MMS and electronic marketing in Gibraltar in addition to the Gibraltar GDPR and Data Protection Act 2004.observed
  5. ConfirmedOneTrust DataGuidance — The GRA's investigation into the Royal Gibraltar Police confirmed data protection violations relating to both law-enforcement and employment-purpose processing of personal data.observed
  6. ConfirmedOneTrust DataGuidance — GRA's exemptions guidance outlines exemptions available under the DPA 2004 and GDPR for, among other things, health, social work, and education processing.observed