--- title: "Isle of Man Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/isle-of-man/ source_html: /jurisdictions/isle-of-man/index.html description: "Isle of Man data protection and privacy regulation: 10 categories, 62 claims, updated 2026-10-25." generated_at: 2026-11-07T14:58:19Z content_sha256: de5ff637960226f1767f3f96f19b7efd5799b239bcebfdd6d4af7d8fd7b21197 generator: "fe-fleet/md-twin@1.0" --- # Isle of Man Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) Last updated 2026-10-25 · 10 categories · 62 claims · 31 sources in the cumulative register Download report (PDF) Expand all The Isle of Man's dual adequacy status advanced materially this cycle with the confirmed entry into force of the Data Protection (Law Enforcement) (Adequacy) (Isle of Man) Regulations 2025, UK Statutory Instrument 2025/89, on 20 February 2025. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Controller/Processor Duties, AdTech & Commercial Privacy, Children & Vulnerable Groups (3 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ISLE-OF-MAN)[Build Report](/reports/?j=ISLE-OF-MAN)[Compare](/compare/?j=ISLE-OF-MAN) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Isle of Man Information Commissioner Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 2 Red categories 57 Sub-modules 62 Claims 2 Tier-1 sources Traffic-light mix 5 green 3 amber 2 red (sums to 10 rendered categories; click to filter) 2 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 797 Full executive summary 367 ###### Latest update · 25 October 2026 #### Lead Signal The Isle of Man's Information Commissioner has continued to increase the volume and visibility of published regulatory action, including a reprimand issued to the Cabinet Office, published on 10 August 2026. This builds on a standing enforcement record for the 2025-26 reporting year that recorded 200 personal data breaches, up from 152 the prior year, affecting an estimated 31,600 people, alongside five regulatory actions including reprimands directed at Shell Ship Management Ltd, Queen Elizabeth II High School, Payroll Partners Ltd and Manx Care, plus one formal warning. The combination of rising breach volumes and a more visible publication practice around regulatory outcomes points to an enforcement posture that is becoming more active without any corresponding change to the underlying statutory penalty ceiling, which remains capped at GBP 1,000,000 under regulation 112 of the Implementing Regulations, applying despite the higher cap that would otherwise follow from Article 83 of the Applied GDPR. A Department of Infrastructure decision notice, reported on 16 October 2026, found that the Department relied on broad and irrelevant factors when refusing to release a document under a freedom of information request, representing a further instance of the Commissioner exercising redress powers against public-sector bodies in the period immediately preceding this reporting window. Taken together, these developments describe a regulator whose redress function, both under data protection and freedom of information powers, is being exercised with increasing frequency against public authorities on the Island. #### Other Developments Statutory penalty cap confirmed unchanged. The maximum administrative penalty available to the Commissioner under regulation 112 of the Implementing Regulations remains GBP 1,000,000, a figure that applies in place of the higher ceiling that Article 83 of the Applied GDPR would otherwise impose. No change to this cap was identified in the period, and it continues to represent a structural constraint on the scale of financial sanction available even as enforcement volume and visibility increase. #### Cross-Monitor Connections The rise in published enforcement action, and the Department of Infrastructure finding specifically, may be of interest to monitors tracking the operation of public bodies and governance standards on the Island, though the underlying subject matter here is squarely a data-protection and freedom-of-information enforcement question rather than a financial-integrity or payments-sector one, and is not re-analysed through those lenses here. #### Outlook The trajectory of rising breach-notification volumes alongside increasingly visible enforcement action is likely to continue as a standing feature of the Commissioner's published activity. Whether the capped GBP 1,000,000 penalty ceiling comes under renewed scrutiny as enforcement activity increases is a question the available material does not yet answer. 5 earlier updates not shown here. ###### Standing brief · as of 5 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The Isle of Man's dual adequacy status advanced materially this cycle with the confirmed entry into force of the Data Protection (Law Enforcement) (Adequacy) (Isle of Man) Regulations 2025, UK Statutory Instrument 2025/89, on 20 February 2025. This Regulation specifies that the Isle of Man ensures an adequate level of protection for law-enforcement-purpose transfers of personal data from UK competent authorities, confirmed at high confidence. The UK Information Commissioner's Opinion, underpinning this Regulation, concluded it was reasonable for the Secretary of State to find the Isle of Man provides an adequate level of data protection for law-enforcement transfers, also confirmed at high confidence. #### Other Developments EU general-processing adequacy remains in place and was reaffirmed. The European Commission granted the Isle of Man an adequacy decision in 2004 covering general, non-law-enforcement processing. This decision was confirmed in January 2024 to continue operating satisfactorily, subject to ongoing monitoring, in a finding assessed at the Assessed confidence tier and sourced to secondary commentary rather than the Commission's own primary text. This long-standing adequacy status is distinct from, and predates, the newer UK law-enforcement adequacy regulation, and it is also distinct from the adequacy positions separately held by Guernsey and Jersey. #### Cross-Monitor Connections The Isle of Man's law-enforcement data-transfer adequacy connects to the financial-integrity monitor's coverage of the Island's MONEYVAL mutual evaluation readiness, insofar as cross-border information-sharing capacity between UK and Isle of Man competent authorities may bear on financial-crime cooperation more broadly, though that connection is not itself the subject of either finding reported here. #### Outlook The Isle of Man's combination of longstanding EU general-processing adequacy since 2004 and now-confirmed UK law-enforcement adequacy since February 2025 is understood, at high confidence, to position the Island favourably relative to other Crown Dependencies for cross-border data flows in both commercial and law-enforcement contexts. No IM Information Commissioner enforcement activity or fines over the last twelve months were identified this cycle, a coverage gap rather than a finding of stability, and remain to be established in a future pass. Read full brief · 797 words ###### Latest update · 28 September 2026 #### Regulatory Status The Isle of Man operates a GDPR-equivalent data-protection regime under the Data Protection Act 2018, supervised by the Isle of Man Information Commissioner, a body statutorily distinct from the UK Information Commissioner's Office. The Island holds a long-standing European Commission adequacy decision (since April 2004, reaffirmed following a January 2024 periodic review) and a confirmed UK law-enforcement adequacy mechanism under SI 2025/89, in force since 20 February 2025. Current administrative activity includes a proposed revision to annual data-protection registration fees following public consultation, and a reported (as yet uncorroborated) increase in breach-impacted individuals for Q4 2025/26. A new Information Commissioner has been in post since September 2024. #### Outlook The fee-revision consultation's finalisation and any corroboration of the reported breach-volume figures against the Information Commissioner's own annual report are the two markers most likely to move this jurisdiction's regulatory-status assessment in the near term. 1 earlier update not shown here. ###### Standing brief · as of 5 September 2026 #### Regulatory Status The Isle of Man's data protection regime continues to operate on a GDPR-mirroring basis under the Data Protection Act 2018, which enables adoption of EU GDPR and Law Enforcement Directive provisions as Manx law via the GDPR and LED Implementing Regulations 2018. This cycle's material development concerns cross-border adequacy rather than the domestic framework itself: the Data Protection (Law Enforcement) (Adequacy) (Isle of Man) Regulations 2025 (UK SI 2025/89) came into force on 20 February 2025, confirming the Isle of Man provides an adequate level of protection for law-enforcement-purpose data transfers from UK competent authorities, underpinned by a supportive UK Information Commissioner's Opinion. This sits alongside the Island's longstanding EU adequacy decision, dating to 2004 for general processing and reaffirmed in January 2024 as continuing to operate satisfactorily subject to ongoing monitoring. #### Outlook The Island's dual adequacy status positions it favourably among Crown Dependencies for both commercial and law-enforcement cross-border data flows. No Isle of Man Information Commissioner enforcement activity or fines over the past twelve months were identified this cycle; this is recorded as a coverage gap rather than a finding of regulatory stability. Read full brief · 367 words Key regulatory facts for Isle of Man Regulatory Dimension Isle of Man Standing Position Jurisdiction Isle of Man (IM) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 62 sourced findings) Regulator & Framework Comprehensive GDPR-equivalent statute in force with an active, independent regulator and established enforcement track record. Lawful Processing & Special Data Core lawful-basis and special-category architecture is inherited wholesale from GDPR, but the specific Manx adaptations to consent thresholds and pseudonymisation/anonymisation safe-harbours were not independently... Data Subject Rights Access right is demonstrably enforced with real cases; deadlines are evidenced through an enforcement action citing multi-month delay. Controller/Processor Duties Security and breach-notification obligations are actively enforced with a live, named 2025 investigation; other accountability sub-modules rely on inherited-adoption inference only. Primary Instruments Cited DataGuidance, DataGuidance, Isle of Man Government, Cabinet Office of the Isle of Man Government, UK Legislation (legislation.gov.uk) Last Confirmed / Updated 2026-10-25 (31 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Isle of Man: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive GDPR-equivalent statute in force with an active, independent regulator and established enforcement track record. Primary framework Data Protection Act 2018 (Isle of Man), operationalised via the Data Protection (Application of GDPR) Order 2018 and the LED Implementing Regulations 2018 Supervisory authority Isle of Man Information Commissioner Traffic-light rationale — Green Comprehensive GDPR-equivalent statute in force with an active, independent regulator and established enforcement track record. #### Sub-modules (5) #### Regulator And AuthorityGreen The Isle of Man Information Commissioner is the independent authority for information rights on the Island, including data protection. Claims (3): - Isle of Man Information Commissioner serves as the independent regulatory authority for information rights, including data protection, on the Isle of Man. Standing institutional fact anchored on a T3 overview source only; no dedicated Manx statute page independently confirmed in this pass. - Isle of Man Information Commissioner's office — a separate statutory body from the UK ICO, currently held by Dr Alexandra Delaney-Bhattacharya (appointed 2024), also overseeing FOI Act 2015 and Unsolicited Communications Regulations 2005 - The Isle of Man Information Commissioner is a separate statutory supervisory authority from the UK Information Commissioner's Office. #### Act And InstrumentsGreen The Applied GDPR Order 2018 and LED Implementing Regulations 2018 give the EU GDPR/LED domestic legal effect under the Data Protection Act 2018. Claims (6): - Data Protection (Application of GDPR) Order 2018 gives domestic legal effect to the EU GDPR under the Isle of Man's Data Protection Act 2018, with local adaptations. Core instrument establishing the Manx GDPR-equivalent regime. - LED Implementing Regulations 2018 gives domestic legal effect to the EU Law Enforcement Directive under the Isle of Man's Data Protection Act 2018. Establishes the separate law-enforcement processing regime alongside the Applied GDPR. - Data Protection Act 2018 (Isle of Man) — EU data protection as part of Manx law via the GDPR and LED Implementing Regulations 2018 - Data Protection Act 2018 (Isle of Man) — The Data Protection Act 2018 applies GDPR and the Law Enforcement Directive as Manx domestic law via the GDPR and LED Implementing Regulations 2018, replacing the Data Protection Act 2002. - Data Protection Act 2018 (Isle of Man) — No amending instrument identified this cycle - Data Protection Act 2018 (Isle of Man) — A short enabling statute; substantive obligations derive from GDPR and LED as applied by the GDPR Order 2018 and LED Order 2018 and associated Implementing Regulations 2018 #### Material ScopeGreen Manx enforcement practice confirms the Applied GDPR's substantive articles (e.g. Arts 12 and 15 on access/transparency) are directly enforced against controllers, including government departments and health bodies. Claims (1): - Isle of Man Information Commissioner enforces Applied GDPR substantive articles (e.g. Arts 12 and 15 on access/transparency) against controllers including government departments and health bodies. Anchored on two enforcement actions (DHA 2020, Manx Care 2021), both T3-tier sources. #### Territorial ScopeGreen The Isle of Man is deemed a Member State of the EU solely for the purposes of the GDPR and LED, a bespoke construct enabling continuity of data flows. Claims (1): - Isle of Man is deemed a Member State of the EU solely for the purposes of the GDPR and LED, a bespoke construct enabling continuity of data flows. Standing territorial-scope construct. #### Regulator Registration And FilingRed No Manx-specific controller registration/notification-fee instrument (analogous to the UK's Data Protection (Charges and Information) Regulations 2018) was identified in this research pass. Claims (2): - Isle of Man controllers — the Data Protection Act 2002 registration/renewal requirement during the interim period prior to the 2018 Regulations coming into force - The Isle of Man Information Commissioner proposed revised annual data-protection registration fees, including fee adjustments and exemptions, following public consultation. The Isle of Man (a self-governing British Crown Dependency, not part of the UK or EU) operates a GDPR-equivalent omnibus regime. It has chosen to adopt the EU GDPR and the Law Enforcement Directive (LED) by order under its own Data Protection Act 2018, principally via the Data Protection (Application of GDPR) Order 2018 ('Applied GDPR') and the LED Implementing Regulations 2018, with local adaptations. The Isle of Man Information Commissioner is the independent regulator overseeing data protection, the Unsolicited Communications Regulations, and Freedom of Information law. Registration/filing specifics for controllers under the Manx regime were not located in this research pass. Periodic update · new data 2026-09-28 #### Regulator & Framework The Isle of Man Information Commissioner is a separate statutory supervisory authority from the UK Information Commissioner's Office, notwithstanding the similarity in naming and function. The core statutory basis for data protection on the Island is the Data Protection Act 2018, which applies the GDPR and the Law Enforcement Directive as Manx domestic law via the GDPR and LED Implementing Regulations 2018. This replaced the earlier Data Protection Act 2002 and remains the stable foundation of the regime. The one active development within this module this cycle is procedural rather than substantive: the Information Commissioner has proposed revised annual data-protection registration fees, including fee adjustments and exemptions, following a public consultation exercise. The proposal's finalisation date and the instrument through which it will take effect have not yet been confirmed from the sources retrieved this cycle. #### Outlook The fee-revision proposal is expected to move toward finalisation, provisionally estimated around Q4 2026, though this is held at Uncertain confidence given the absence of a confirmed instrument or date. Confirmation of the finalised fee schedule would be the clearest marker of progress in this module. Sources and claims (13) - [DataGuidance](https://www.dataguidance.com/notes/isle-man-data-protection-overview) — Isle of Man Information Commissioner serves as the independent regulatory authority for information rights, including data protection, on the Isle of Man. Standing institutional fact anchored on a T3 overview source only; no dedicated Manx statute page independently confirmed in this pass. - [DataGuidance](https://www.dataguidance.com/notes/isle-man-data-protection-overview) — Data Protection (Application of GDPR) Order 2018 gives domestic legal effect to the EU GDPR under the Isle of Man's Data Protection Act 2018, with local adaptations. Core instrument establishing the Manx GDPR-equivalent regime. - [DataGuidance](https://www.dataguidance.com/notes/isle-man-data-protection-overview) — LED Implementing Regulations 2018 gives domestic legal effect to the EU Law Enforcement Directive under the Isle of Man's Data Protection Act 2018. Establishes the separate law-enforcement processing regime alongside the Applied GDPR. - [DataGuidance](https://platform.dataguidance.com/news/isle-man-commissioner-issues-enforcement-notice-dha-gdpr-violations) — Isle of Man Information Commissioner enforces Applied GDPR substantive articles (e.g. Arts 12 and 15 on access/transparency) against controllers including government departments and health bodies. Anchored on two enforcement actions (DHA 2020, Manx Care 2021), both T3-tier sources. - [DataGuidance](https://www.dataguidance.com/notes/isle-man-data-protection-overview) — Isle of Man is deemed a Member State of the EU solely for the purposes of the GDPR and LED, a bespoke construct enabling continuity of data flows. Standing territorial-scope construct. - [Isle of Man Government](https://www.gov.im/about-the-government/data-protection-gdpr-on-the-isle-of-man/) — Data Protection Act 2018 (Isle of Man) — EU data protection as part of Manx law via the GDPR and LED Implementing Regulations 2018 - [DataGuidance](https://www.dataguidance.com/notes/isle-man-data-protection-overview) — Isle of Man Information Commissioner's office — a separate statutory body from the UK ICO, currently held by Dr Alexandra Delaney-Bhattacharya (appointed 2024), also overseeing FOI Act 2015 and Unsolicited Communications Regulations 2005 - [Cabinet Office of the Isle of Man Government](https://consult.gov.im/cabinet-office/new-data-protection-bill/) — Isle of Man controllers — the Data Protection Act 2002 registration/renewal requirement during the interim period prior to the 2018 Regulations coming into force - [UK Legislation (legislation.gov.uk)](https://www.legislation.gov.uk/uksi/2025/89/made/data.html) — The Isle of Man Information Commissioner is a separate statutory supervisory authority from the UK Information Commissioner's Office. - [Isle of Man Government](https://www.gov.im/about-the-government/data-protection-gdpr-on-the-isle-of-man/data-protection-for-businesses/) — Data Protection Act 2018 (Isle of Man) — The Data Protection Act 2018 applies GDPR and the Law Enforcement Directive as Manx domestic law via the GDPR and LED Implementing Regulations 2018, replacing the Data Protection Act 2002. - [Isle of Man Government](https://www.gov.im/about-the-government/data-protection-gdpr-on-the-isle-of-man/) — The Isle of Man Information Commissioner proposed revised annual data-protection registration fees, including fee adjustments and exemptions, following public consultation. - [https://www.dataguidance.com/jurisdictions/isle-of-man](https://www.dataguidance.com/jurisdictions/isle-of-man) — Data Protection Act 2018 (Isle of Man) — No amending instrument identified this cycle - [https://anuragverma.co/worldwatch/isle-of-man/data-privacy](https://anuragverma.co/worldwatch/isle-of-man/data-privacy) — Data Protection Act 2018 (Isle of Man) — A short enabling statute; substantive obligations derive from GDPR and LED as applied by the GDPR Order 2018 and LED Order 2018 and associated Implementing Regulations 2018 ### Isle of Man: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core lawful-basis and special-category architecture is inherited wholesale from GDPR, but the specific Manx adaptations to consent thresholds and pseudonymisation/anonymisation safe-harbours were not independently verified in primary Manx legislative text during this pass. Primary framework Applied GDPR (Data Protection (Application of GDPR) Order 2018) Supervisory authority Isle of Man Information Commissioner Traffic-light rationale — Amber Core lawful-basis and special-category architecture is inherited wholesale from GDPR, but the specific Manx adaptations to consent thresholds and pseudonymisation/anonymisation safe-harbours were not independently verified in primary Manx legislative text during this pass. D2 · Lawful Processing — Full Module Record 4 sub-modules · 53 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Isle of Man: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Access right is demonstrably enforced with real cases; deadlines are evidenced through an enforcement action citing multi-month delay. Primary framework Applied GDPR (Data Protection (Application of GDPR) Order 2018) Supervisory authority Isle of Man Information Commissioner Traffic-light rationale — Green Access right is demonstrably enforced with real cases; deadlines are evidenced through an enforcement action citing multi-month delay. #### Sub-modules (5) #### Access RightGreen Two separate Manx enforcement notices (DHA, 2020; Manx Care, 2021) found continuous failures to comply with the right of access under Applied GDPR Articles 12 and 15. Claims (3): - Isle of Man Information Commissioner issued enforcement notice against the Department of Home Affairs (2020) for continuous failure to comply with the right of access under Applied GDPR Articles 12 and 15. Direct Manx enforcement precedent on access rights. - Isle of Man Information Commissioner issued enforcement notice against Manx Care (2021) for continuous failure to comply with the right of access under Applied GDPR Articles 12 and 15. Second Manx enforcement precedent on access rights, against the public healthcare provider. - Isle of Man data subjects — Access, rectification, erasure, restriction, portability and objection rights mirroring GDPR #### Rectification And ErasureAmber Rectification/erasure rights are presumed inherited from the fully-adopted Applied GDPR text; no independent Manx enforcement precedent located. #### Restriction And ObjectionAmber Restriction/objection rights are presumed inherited from the Applied GDPR; no Manx-specific precedent located. #### Data PortabilityAmber Portability right presumed inherited from the Applied GDPR; no Manx-specific precedent located. #### Deadlines And Response WindowsGreen The Manx Care enforcement action evidenced regulatory intolerance of subject access delay of more than four months, consistent with the GDPR's one-month (extendable) statutory response deadline being applied in practice. Claims (1): - Isle of Man Information Commissioner found non-compliance exceeding four months for a subject access request response, consistent with GDPR's one-month (extendable) statutory response deadline being applied in practice. Evidences operative deadline enforcement via the Manx Care case. The Manx Information Commissioner has directly enforced data subject access rights (Applied GDPR Articles 12 and 15) against both a government department (2020) and the publicly-owned healthcare provider Manx Care (2021), including for prolonged non-compliance exceeding four months. This provides strong evidentiary confirmation of an operative, enforced access-rights regime; other rights (rectification, erasure, restriction, objection, portability) are presumed inherited from the same Applied GDPR text but lack independent Manx enforcement evidence located in this pass. No periodic updates recorded in this cycle Sources and claims (4) - [DataGuidance](https://platform.dataguidance.com/news/isle-man-commissioner-issues-enforcement-notice-dha-gdpr-violations) — Isle of Man Information Commissioner issued enforcement notice against the Department of Home Affairs (2020) for continuous failure to comply with the right of access under Applied GDPR Articles 12 and 15. Direct Manx enforcement precedent on access rights. - [DataGuidance](https://www.dataguidance.com/news/isle-man-information-commissioner-issues-enforcement) — Isle of Man Information Commissioner issued enforcement notice against Manx Care (2021) for continuous failure to comply with the right of access under Applied GDPR Articles 12 and 15. Second Manx enforcement precedent on access rights, against the public healthcare provider. - [DataGuidance](https://www.dataguidance.com/news/isle-man-information-commissioner-issues-enforcement) — Isle of Man Information Commissioner found non-compliance exceeding four months for a subject access request response, consistent with GDPR's one-month (extendable) statutory response deadline being applied in practice. Evidences operative deadline enforcement via the Manx Care case. - [https://anuragverma.co/worldwatch/isle-of-man/data-privacy](https://anuragverma.co/worldwatch/isle-of-man/data-privacy) — Isle of Man data subjects — Access, rectification, erasure, restriction, portability and objection rights mirroring GDPR ### Isle of Man: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Security and breach-notification obligations are actively enforced with a live, named 2025 investigation; other accountability sub-modules rely on inherited-adoption inference only. Primary framework Applied GDPR (Data Protection (Application of GDPR) Order 2018) Supervisory authority Isle of Man Information Commissioner Traffic-light rationale — Green Security and breach-notification obligations are actively enforced with a live, named 2025 investigation; other accountability sub-modules rely on inherited-adoption inference only. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Reports suggest 16,600 individuals may have been impacted by data breaches in the Isle of Man during Q4 2025/26, according to secondary-source reporting. This figure has not been corroborated against the Isle of Man Information Commissioner's own annual report this pass, and it is treated with corresponding caution as a reported rather than confirmed statistic. No detail on the nature, sector, or cause of the underlying breaches contributing to this figure has been located this cycle, nor has any accompanying enforcement or notification-compliance finding been identified. #### Outlook Corroboration of the breach-volume figure against the Information Commissioner's own published annual report would resolve the current uncertainty and would also clarify whether this represents a genuine increase in breach-notification activity or a reporting artefact. D4 · Controller & Processor — Full Module Record 7 sub-modules · 83 words · 7 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Isle of Man: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Dual adequacy (EU-received and UK-received) is well documented and recently reconfirmed; granted-adequacy and data-localisation sub-modules lack confirmed Manx-specific sources. Primary framework Applied GDPR transfer provisions (Chapter V equivalent) and Commission Decision 2004/411/EC Supervisory authority Isle of Man Information Commissioner Traffic-light rationale — Green Dual adequacy (EU-received and UK-received) is well documented and recently reconfirmed; granted-adequacy and data-localisation sub-modules lack confirmed Manx-specific sources. Periodic update · new data 2026-09-28 #### Cross-Border & Adequacy The Isle of Man holds a long-standing European Commission adequacy decision, first adopted in April 2004. A periodic review concluded in January 2024 found that the decision continues to provide adequate protection, albeit subject to closer ongoing monitoring going forward, placing the Island among the group of adequacy-holding jurisdictions the Commission reviews periodically rather than treating the original decision as a one-time, permanent grant. Separately, and on the UK side, the Data Protection (Law Enforcement) (Adequacy) (Isle of Man) Regulations 2025, UK Statutory Instrument 2025/89, came into force on 20 February 2025. This instrument formally confirms that the Isle of Man provides a level of protection of personal data essentially equivalent to that in the UK, and it enables UK competent authorities to transfer personal data to Isle of Man authorities for law-enforcement purposes without needing case-by-case authorisation for each transfer. This is a confirmed, dated, Tier-1-sourced instrument. Taken together, the Isle of Man now holds both a reaffirmed EU adequacy status and a confirmed UK law-enforcement adequacy mechanism, a dual-track position that few Crown Dependencies can claim with equal currency on both fronts. This positions the Island favourably for cross-border personal-data flows with both the EU and the UK, though the January 2024 EU review's note of closer ongoing monitoring indicates the adequacy status is not being treated as indefinitely settled by the Commission. #### Outlook No further review of the EU adequacy decision has been scheduled or signalled this cycle beyond the closer ongoing monitoring noted in the January 2024 review. The UK law-enforcement adequacy mechanism under SI 2025/89 is now in force and no further change is pending. The principal marker to watch is any further Commission commentary arising from its heightened monitoring of the Island's adequacy status. Periodic update · new data 2026-09-21 #### Cross-Border & Adequacy The Isle of Man occupies an unusually strong dual-adequacy position for a jurisdiction of its size. It holds a standalone European Union adequacy decision, distinct from the UK's own adequacy status, granted in 2004 -- one of the longest-running such decisions held by any Crown Dependency. This finding rests on a Tier-3 source and carries Probable confidence, since the primary European Commission adequacy decision text was not directly retrieved this cycle, though the underlying fact of a 2004-era Isle of Man adequacy decision is well established in secondary commentary. More recently, the UK Data Protection (Law Enforcement) (Adequacy) (Isle of Man) Regulations 2025 came into force on 20 February 2025. This followed a UK Information Commissioner's Office published opinion setting out the adequacy assessment process the UK Government followed and the factors it considered in assessing the Isle of Man for law-enforcement data transfers specifically -- a narrower category of adequacy than general commercial-processing adequacy, covering data transferred for law-enforcement purposes under the UK's own data protection framework. This is a Confirmed, Tier-1-sourced finding directly from the UK ICO's own published opinion. Taken together, the Island now has two distinct adequacy positions covering two different transfer categories and two different counterpart jurisdictions: EU adequacy for general processing since 2004, and UK law-enforcement adequacy since February 2025. This dual position gives Manx-based controllers and processors a comparatively favourable cross-border transfer environment relative to jurisdictions holding only one adequacy status or none, though the practical benefit of the EU adequacy decision to Manx businesses is itself somewhat dependent on the continuing stability of the UK's own EU adequacy status, since much Isle of Man data flow to the EU is understood to route via or alongside UK data flows. #### Outlook The UK law-enforcement adequacy instrument is newly in force as of February 2025 and its practical operation -- how UK law-enforcement bodies actually exercise data-transfer arrangements with Isle of Man counterparts under it -- is worth monitoring in future cycles as the instrument matures. On the EU side, the Island's adequacy position is a long-standing, stable feature rather than one under near-term review, and no signal this cycle suggests the European Commission is reconsidering it. Periodic update · new data 2026-09-14 #### Cross-Border & Adequacy The Isle of Man holds a long-standing EU adequacy decision, first granted in 2004 and reaffirmed in 2024, distinct from the adequacy statuses held by the UK, Guernsey and Jersey. This general-purpose adequacy finding is now joined by a second, narrower instrument: the UK's Data Protection (Law Enforcement) (Adequacy) (Isle of Man) Regulations 2025 confirm that the Isle of Man provides an adequate level of protection for personal data transferred from the UK for law-enforcement purposes. This confirmed, in-force development followed a positive Opinion from the UK Information Commissioner under section 74A of the UK Data Protection Act 2018, and represents a materially significant addition to the Island's cross-border transfer architecture, since it closes a gap that previously existed for law-enforcement-purpose transfers specifically, as distinct from the Island's general-purpose EU adequacy coverage. The combination of long-standing EU general-purpose adequacy and new UK law-enforcement-purpose adequacy positions the Isle of Man distinctly among the Crown Dependencies, and materially reduces friction for Island-based controllers and public authorities engaged in cross-border data transfers with both the EU and the UK. #### Outlook No threat to either the EU or the new UK law-enforcement adequacy finding was evidenced this cycle. The development to watch is whether Guernsey or Jersey pursue equivalent UK law-enforcement-purpose adequacy instruments, which would affect the Isle of Man's relative positioning among the three Crown Dependencies. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 118 words · 13 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Isle of Man: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Two sectoral overlays are evidenced (health, telecoms/unsolicited communications); financial services, employment, credit, education and insurance overlays are unconfirmed gaps. Supervisory authority Isle of Man Information Commissioner Traffic-light rationale — Amber Two sectoral overlays are evidenced (health, telecoms/unsolicited communications); financial services, employment, credit, education and insurance overlays are unconfirmed gaps. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 68 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Isle of Man: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only the existence of an Unsolicited Communications Regulations regime is confirmed; substantive adtech/commercial-privacy detail is an unconfirmed gap. Supervisory authority Isle of Man Information Commissioner Traffic-light rationale — Red Only the existence of an Unsolicited Communications Regulations regime is confirmed; substantive adtech/commercial-privacy detail is an unconfirmed gap. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 38 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Isle of Man: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core ADM/profiling protection is inherited via full GDPR adoption; AI-specific and biometric/genetic-specific regimes are unconfirmed gaps; a distinct law-enforcement carve-out regime is confirmed to exist. Primary framework Applied GDPR (general) and LED Implementing Regulations 2018 (law enforcement) Supervisory authority Isle of Man Information Commissioner Traffic-light rationale — Amber Core ADM/profiling protection is inherited via full GDPR adoption; AI-specific and biometric/genetic-specific regimes are unconfirmed gaps; a distinct law-enforcement carve-out regime is confirmed to exist. Periodic update · new data 2026-09-21 #### Algorithmic, Biometric & Surveillance Governance The Isle of Man's algorithmic-governance posture this cycle is defined by a single, notable but non-binding development: the Isle of Man Information Commissioner's office joined 61 regulators globally, alongside the Guernsey and Jersey data protection authorities, in issuing a statement of concern about growing misuse of AI systems. Reports suggest this reflects a coordinated multi-jurisdiction regulatory posture on AI risk rather than a unilateral Isle of Man initiative, and it is understood to have been issued via the Commissioner's own news channel. No dedicated Isle of Man AI-specific or biometric-specific regulatory instrument -- whether guidance, code of practice, or binding rule -- has been identified this cycle; the joint statement is the extent of the Island's documented engagement with algorithmic governance at this time. This finding is reported at Probable confidence, reflecting that the joint statement itself is confirmed via a Tier-1 source (the Commissioner's own news feed) but that its practical implications for how the Isle of Man will supervise or enforce against AI-related data-protection harms remain undefined. The statement of concern format -- a joint expression of regulatory anxiety rather than a rule, code or enforcement priority -- means it creates no new binding obligation on controllers or processors operating on the Island, and readers should not treat it as equivalent to an AI-specific code of practice or statutory instrument. #### Outlook The question worth tracking into the next cycle is whether the joint statement of concern is followed by any Isle-of-Man-specific guidance, code of practice, or enforcement priority addressing AI or algorithmic processing under the existing Data Protection Act 2018/GDPR-equivalent framework. Absent such a follow-on instrument, the Island's algorithmic-governance position remains defined entirely by the general lawful-processing and accountability principles of its GDPR-equivalent regime rather than by any AI-specific rule. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 49 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Isle of Man: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ This entire module rests on inference from wholesale GDPR adoption; no Manx-specific children's-data source was independently confirmed. Supervisory authority Isle of Man Information Commissioner Traffic-light rationale — Red This entire module rests on inference from wholesale GDPR adoption; no Manx-specific children's-data source was independently confirmed. D9 · Children's Privacy — Full Module Record 5 sub-modules · 64 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Isle of Man: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Clear, repeated, and recent (through Dec 2025) enforcement activity confirms an active regulator; funding/capacity and redress-mechanism sub-modules remain unconfirmed gaps. Primary framework Data Protection Act 2018 (Isle of Man) enforcement provisions Supervisory authority Isle of Man Information Commissioner Traffic-light rationale — Green Clear, repeated, and recent (through Dec 2025) enforcement activity confirms an active regulator; funding/capacity and redress-mechanism sub-modules remain unconfirmed gaps. Periodic update · new data 2026-10-25 #### Enforcement & Redress The Isle of Man Information Commissioner is understood to have increased the volume and public visibility of regulatory action over the course of the period, including a reprimand issued to the Cabinet Office that was published on 10 August 2026. This sits alongside a standing enforcement record for the 2025-26 reporting year, in which 200 personal data breaches were reported, a rise from 152 in the prior year, with an estimated 31,600 people affected across those incidents. Five regulatory actions accompanied that enforcement record: reprimands directed at Shell Ship Management Ltd, Queen Elizabeth II High School, Payroll Partners Ltd and Manx Care, together with one formal warning. The pattern across these figures and the Cabinet Office reprimand is one of a regulator exercising its enforcement function more visibly, rather than one of a sudden spike in the underlying volume of reportable incidents, since the five regulatory actions already recorded against the 2025-26 breach total pre-date the publication of the Cabinet Office matter. The statutory ceiling on the Commissioner's administrative-penalty power has not changed in this period: regulation 112 of the Implementing Regulations continues to cap the maximum administrative penalty at GBP 1,000,000, a figure that applies in place of the higher ceiling that would otherwise follow from Article 83 of the Applied GDPR. This cap represents a structural constraint distinct from the volume or visibility of enforcement activity; the Commissioner can increase how often and how publicly it exercises its powers without that increase altering the maximum financial exposure any single enforcement action can carry. A further redress-function development, reported on 16 October 2026, concerns a decision notice against the Department of Infrastructure, which was found to have relied on broad and irrelevant factors when refusing to release a document under a freedom of information request. While this sits under the Commissioner's freedom-of-information jurisdiction rather than the data-protection regime specifically, it is part of the same office's redress function and reflects a comparable pattern of active engagement with public-sector decision-making. Taken together, the Cabinet Office reprimand, the broader 2025-26 enforcement statistics, and the Department of Infrastructure decision notice describe an Information Commissioner whose redress and enforcement posture toward public bodies, in particular, has become more visibly active over the period under review, without any corresponding change to the statutory tools or penalty ceilings available to it. #### Outlook The trajectory of rising breach-notification volumes alongside more visible enforcement and redress activity is likely to continue, based on the pattern evident in the 2025-26 statistics and the Cabinet Office and Department of Infrastructure matters. Whether this pattern of increasing visibility eventually prompts scrutiny of the GBP 1,000,000 penalty cap, or whether that cap remains adequate to the scale of enforcement activity now being recorded, is not something the available material resolves. Further published regulatory actions in subsequent periods would be the clearest indicator of whether the current trajectory persists. Periodic update · new data 2026-10-18 #### Enforcement & Redress The Isle of Man Information Commissioner issued a Freedom of Information decision notice on 16 October 2026 against the Department of Infrastructure. The notice directs the Department to disclose the information it had withheld or to issue a proper refusal, with the Commissioner finding that the Department had relied on broad and irrelevant public-interest factors in support of its withholding decision. This is a confirmed action issued under the Commissioner's Freedom of Information jurisdiction rather than under the Data Protection Act 2018 directly, though both functions sit with the same regulatory office. Standing context for this module includes the Commissioner's most recently reported Annual Report figures, covering 2025/26 and published in July 2026, which recorded 200 personal data breaches in that reporting year, up from 152 the previous year, alongside five regulatory actions including reprimands issued to Shell Ship Management Ltd, Queen Elizabeth II High School, Payroll Partners Ltd and Manx Care. These figures predate the current cycle's window but remain the most recent confirmed enforcement-activity data available for the jurisdiction. Separately, a secondary source places the maximum administrative fine under the Isle of Man Data Protection Act 2018 at GBP 1,000,000, though the primary statutory pinpoint for that figure was not confirmed this cycle. #### Outlook Whether the Department of Infrastructure complies with the Commissioner's FOI direction, and whether any further action follows non-compliance, is the near-term item to watch. More broadly, confirmation of any Data Protection Act-specific enforcement action (reprimand, enforcement notice or fine) in the period immediately surrounding this cycle, beyond the FOI decision notice, remains an open gap, as does verification of the primary statutory basis for the reported GBP 1,000,000 maximum administrative fine. Periodic update · new data 2026-10-11 #### Enforcement & Redress The Isle of Man Information Commissioner's 2025/26 Annual Report recorded a sharp rise in personal-data breach activity: 200 reported breaches affecting an estimated 31,600 people, alongside 53 complaints and five regulatory actions, comprising four reprimands and one warning. The report itself does not establish whether this reflects an increase in underlying incidents or an increase in reporting and regulatory visibility, and both readings remain open pending further data. Separately, a cross-border joint investigation remains active: the UK Information Commissioner's Office announced in December 2025 that it would investigate, jointly with the Jersey, Guernsey and Isle of Man data-protection regulators, a personal-data breach at Prospect Custodian Trustees Ltd affecting over 160,000 members. No concluded outcome from any of the four regulators participating in that investigation has been located this cycle. The joint nature of the investigation, spanning all three Crown Dependencies and the UK regulator, reflects the close institutional cooperation that underpins the Island's data-protection enforcement architecture, distinct from but complementary to its formal adequacy relationship with the UK and EU. #### Outlook The outcome of the Prospect Custodian Trustees Ltd joint investigation is the principal item to watch; no timeline for its conclusion has been indicated by any of the four participating regulators. Whether the 2025/26 rise in breach and complaint figures continues, stabilises or reflects a one-off reporting effect will likely only become clear with the next Annual Report cycle. Periodic update · new data 2026-09-28 #### Enforcement & Redress The most recent developments in this module are administrative rather than adjudicative. A new Information Commissioner has been in post since September 2024, and the most recent activity associated with the office includes a proposed Data Asset Register initiative and the fee-revision consultation discussed under Regulator & Framework above. No specific enforcement action, fine, or redress decision has been identified for the Isle of Man this cycle. The reported increase in breach-impacted individuals for Q4 2025/26, discussed under Controller/Processor Duties, has not yet translated into any identified enforcement response from the Information Commissioner, and the underlying figure itself remains uncorroborated against a primary source this cycle. #### Outlook With a relatively new Information Commissioner in post, the direction of enforcement posture under this office is still establishing itself. The proposed Data Asset Register initiative and the fee-revision consultation are the two concrete markers of current regulatory activity; any enforcement action arising from the reported Q4 2025/26 breach figures, once corroborated, would be a significant marker for this module. Periodic update · new data 2026-09-21 #### Enforcement & Redress The Isle of Man's enforcement and redress picture this cycle rests on notably thinner primary sourcing than its framework and adequacy position. The Island's data protection regime is reported to cap the maximum administrative fine at GBP 1,000,000, materially lower than the EU GDPR ceiling of EUR 20,000,000 or 4% of global annual turnover. This figure is reported only, not confirmed: it rests on a single Tier-3 aggregator source, and the primary statutory penalty provisions of the Data Protection Act 2018 and the GDPR and LED Implementing Regulations 2018 were not directly retrieved this cycle to verify the figure against the legislation itself. On enforcement activity, the Isle of Man Information Commissioner is reported to have issued at least three Enforcement Notices since April 2024, including urgent notices. This too rests on the same single Tier-3 aggregator source, with no primary enforcement-notice register located this cycle to corroborate the count or characterise the substance of those notices. Reports suggest an active but modest enforcement posture, though the underlying evidentiary basis for that characterisation remains thin. Separately, the Office of the Data Protection Supervisor, now operating as the Information Commissioner's office, is reported to be funded by a mix of Isle of Man Treasury funding and registration fees, while remaining institutionally independent of the Isle of Man Government. This funding-and-capacity finding rests on a Tier-4 source and is reported at Uncertain confidence; it bears on the regulator's practical enforcement capacity but has not been independently corroborated against a primary budgetary or statutory source. #### Outlook The clearest gap to close in the next cycle is primary-source verification of the statutory maximum administrative fine, ideally sourced directly to legislation.gov.im or an equivalent primary Isle of Man legislative database, which would allow this figure to move from Uncertain to a more assertive confidence tier. A primary Isle of Man Information Commissioner enforcement-notice register, if one exists in published form, would similarly firm up the currently thin enforcement-activity count. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 98 words · 12 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 8 [Children & Vulnerable Groups](#sec-cat-children_and_vulnerable_groups) parental consent Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties