--- title: "MH Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/mh-data-protection-privacy-regulation/ source_html: /jurisdictions/marshall-islands/index.html description: "MH data protection and privacy regulation: 10 categories, 21 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: a670655a9c585fd461e0e7593aa8db7bc3dcf0665173a3243453736557d7a56e generator: "fe-fleet/md-twin@1.0" --- # MH Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/marshall-islands/), [World Payments](https://payments.gi/jurisdictions/marshall-islands/) Last updated 2026-10-25 · 10 categories · 21 claims · 9 sources in the cumulative register Download report (PDF) Expand all The Marshall Islands has, for the first time, a dedicated personal-data statute on its books. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework (4 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=MARSHALL-ISLANDS)[Build Report](/reports/?j=MARSHALL-ISLANDS)[Compare](/compare/?j=MARSHALL-ISLANDS) Framework posture Unregulated gap 7 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority DataGuidance Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 7 / 10 modules assessed 0 Confirmed · 7 Probable · 0 Uncertain · 3 Not yet assessed 10 Categories 6 Red categories 58 Sub-modules 21 Claims 1 Tier-1 sources Traffic-light mix 6 red 3 n/a 1 amber (sums to 10 rendered categories; click to filter) 6 categories flagged red ## Jurisdiction lead brief ###### Latest update · 25 October 2026 #### Lead Signal The Marshall Islands' Personal Data Protection Act 2025 (PL 2025-43, 6 MIRC Ch.4) is approaching its commencement date. The Act takes effect twelve months after the date of constitutional certification, which the Act itself dates to 7 October 2025, placing the effective date at or around 7 October 2026. The Act designates EPSSO as the competent authority, but its application is confined to core Government ministries and agencies; private-sector processing of personal data sits outside the statute's reach. As commencement nears, the Act's remedies for contraventions by government bodies also come into focus, though those remedies expressly exclude compensatory relief against government agencies, and no penalty schedule applicable to private-sector data handling has been located. #### Other Developments No other dated instrument or enforcement development was identified. #### Cross-Monitor Connections No cross-monitor routing was identified. #### Outlook As the Act's commencement date around 7 October 2026 arrives, the Marshall Islands' data protection framework will formally come into force for the first time, but only for core Government ministries and agencies. The private sector will continue to operate without a general data-protection law, a dedicated data protection authority, or a private-sector enforcement and redress regime. Whether EPSSO's new role under the Act extends further in practice, or whether a parallel private-sector framework is contemplated, remains to be seen as the commencement date is reached. 1 earlier update not shown here. ###### Standing brief · as of 4 October 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The Marshall Islands has, for the first time, a dedicated personal-data statute on its books. Primary legislative text obtained from the RMI Parliament (Nitijela) confirms that the Personal Data Protection Act 2025 is in force and imposes a concrete, dated compliance duty: core Government ministries and agencies must inform the competent authority on a yearly basis, by 1 July of each year, of the information and actions specified in the Act. The Act's own text, however, also confirms that its material scope runs to core Government ministries and agencies, not to the private sector generally. This is a structural fact rather than an incidental drafting choice: the Marshall Islands moves from having no personal-data-protection statute at all to having a public-sector-only one, and the distance between those two positions is the entire story this cycle. A second-tier commercial tracker separately asserts that there is no general personal data protection law in the jurisdiction. Read together with the primary text, this is not a contradiction so much as a scope clarification: the 2025 Act exists, is in force, and is binding on the government bodies it names, while the broader claim that there is no general law continues to hold for the private sector, which the Act does not appear to reach. #### Other Developments An annual reporting duty with a liability-protection concept attached. Beyond the headline annual filing obligation, the primary text also establishes what has been described as a section 415 safe-harbor liability-protection concept for bodies subject to the Act. The precise mechanics of how this protection operates, and against what, were not resolved from the text retrieved this cycle; the duty to report annually by 1 July is the confirmed element, and the safe-harbor concept is noted as a related feature of the same controller/processor architecture rather than as a separately verified obligation. A secondary account of a wider 2025 digital-law package remains uncorroborated. A digital-policy tracker describes the Marshall Islands as having adopted a compact but consequential package of digital laws in 2025, which would sit alongside the Personal Data Protection Act. That broader package has not been independently verified against primary RMI Parliament text this cycle, and is therefore not treated here as established alongside the confirmed Act. #### Cross-Monitor Connections The emergence of a government-facing data-protection statute in a jurisdiction otherwise known chiefly for its open corporate and ship registries is a detail of interest to the financial-integrity monitor, where the same registry architecture has been the subject of sustained attention this cycle; the two monitors are tracking different instruments in the same jurisdiction and the data-protection finding does not alter the financial-integrity picture, but the coincidence of a maturing public-sector data regime alongside persistent corporate-registry opacity is worth noting as parallel, not connected, developments. #### Outlook The open question carried into the next cycle is whether the Personal Data Protection Act 2025's core-Government scope is the Act's permanent and complete reach, as its purpose clause suggests, or whether further implementing provisions extend obligations toward private-sector controllers. Until that is resolved against primary text, the Marshall Islands should be read as having a narrow, public-sector personal-data statute with a confirmed annual reporting cadence, sitting inside a jurisdiction that otherwise has no general data-protection law. Read full brief · 795 words Key regulatory facts for MH Regulatory Dimension MH Standing Position Jurisdiction MH (MH) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 21 sourced findings) Regulator & Framework No omnibus instrument and no general supervisory authority; only constitutional/criminal-law and sectoral fragments found. Lawful Processing & Special Data No comprehensive regime; absent_field_provenance applies to the entire module. Data Subject Rights No comprehensive regime for this module; empty claims with explicit rationale per gap discipline. Controller/Processor Duties No comprehensive controller/processor obligations regime identified. Primary Instruments Cited DataGuidance, Republic of the Marshall Islands (hosted copy), Nitijela (RMI Parliament), Nitijela (RMI Parliament), MH Official Instrument (dataguidance.com marshall-islands) Last Confirmed / Updated 2026-10-25 (9 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### MH: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No omnibus instrument and no general supervisory authority; only constitutional/criminal-law and sectoral fragments found. Traffic-light rationale — Red No omnibus instrument and no general supervisory authority; only constitutional/criminal-law and sectoral fragments found. #### Sub-modules (5) #### Regulator And AuthorityRed No general data protection authority exists in RMI. Claims (2): - The Republic of the Marshall Islands does not have a general data protection authority. - Personal Data Protection Act 2025 (P.L. 2025-43) — Section 408 imposes a duty of confidentiality on any director, employee, consultant, or other person engaged by the 'competent authority' in respect of personal data obtained while performing duties under the Chapter. #### Act And InstrumentsRed No general personal data protection law exists; searched for an RMI omnibus DP act, a DPA-enabling statute, and any pending bill — none located. Claims (3): - The Republic of the Marshall Islands does not have a general/omnibus personal data protection law. - Criminal Code 2011 and the Constitution remain MH's only private-sector-applicable privacy provisions. - Personal Data Protection Act 2025 (P.L. 2025-43) — Takes effect twelve months after certification (commencement 2025-10-07, calculated general effect ~2026-10-07); binds core Government ministries and agencies only; EPSSO is competent authority. #### Material ScopeAmber Material scope of privacy protection is defined only by the Constitution (general privacy right) and the Criminal Code 2011 (specific intrusion offences), not by any data-processing-specific statute. Claims (2): - Section 13 of the Constitution of the Republic of the Marshall Islands provides a general right to be free from unreasonable interference in personal choices and from unreasonable intrusions into privacy, operating as the sole constitutional-level privacy protection absent any data-processing statute. - Section 250.12 of the Criminal Code 2011 [31 MIRC Ch.1] covers unlawful eavesdropping or surveillance and breach of privacy of messages, framing such conduct as a criminal offence rather than a data-processing obligation. #### Territorial ScopeRed No territorial-scope / extraterritoriality provision exists because there is no controller-facing DP statute to carry one. Searched RMI Criminal Code, Constitution and sectoral acts for an establishment/targeting test; none found. #### Regulator Registration And FilingRed No registration, notification or filing duty on controllers exists; there is no regulator to register with. Searched for a controller-registration scheme; none found. The Republic of the Marshall Islands (RMI) has no comprehensive/omnibus data-protection statute and no dedicated data-protection authority. Privacy-adjacent protection exists only as: (i) a constitutional privacy guarantee, (ii) a criminal-law prohibition on specific privacy intrusions, and (iii) fragmented sectoral confidentiality provisions in banking, tax and AML law. No registration/filing regime for controllers exists because no controller-facing statute exists. Periodic update · new data 2026-10-25 #### Regulator & Framework The Personal Data Protection Act 2025 (PL 2025-43, 6 MIRC Ch.4) is the Marshall Islands' only data protection statute, and it is approaching the point at which it becomes legally effective. The Act's own commencement notation provides that it takes effect twelve months after the date of constitutional certification, dated to 7 October 2025, placing the effective date at or around 7 October 2026. The Act designates EPSSO as the competent authority under the statute. Its material scope is limited: the Act binds personal data processed by core Government ministries and agencies only, and that limitation is itself a binding feature of the law rather than an interim gap expected to close. Processing of personal data by private businesses in the Marshall Islands sits outside the Act entirely, and no general data-protection law, dedicated supervisory authority, or private-sector compliance regime exists alongside it. #### Outlook As the commencement date around 7 October 2026 is reached, the Act's government-sector-only principles and associated complaint and remedy provisions become legally operative for the first time, bringing EPSSO's role as competent authority into active use. The structural limitation to core Government ministries and agencies is written into the statute itself, so commencement does not of itself extend the regime to private-sector controllers or processors. Whether a broader, general-application data protection law is contemplated for the private sector remains an open question beyond the scope of the current Act. 1 earlier distinct update(s) Periodic update · new data 2026-10-11 #### Regulator & Framework The Marshall Islands now has its first dedicated data-protection statute. The Personal Data Protection Act 2025, codified at 6 MIRC Chapter 4, establishes an enabling legal framework intended to protect the personal data and privacy of natural persons in the Republic. The Executive Property and Social Security Office, EPSSO, is designated as the competent authority responsible for administering the framework, according to the primary statute text retrieved this cycle, although the specific provision designating EPSSO was not independently pinpointed within that text. The defining feature of this new framework, and the one with the most significant practical implications, is its scope: the Act applies only to core Government ministries and agencies. It is not a general data-protection law of the kind that would cover private-sector controllers and processors, commercial data handling, or data processing by non-governmental organisations. This means that, notwithstanding the enactment of a dedicated statute bearing the title Personal Data Protection Act, the private sector in the Marshall Islands remains without any general data-protection law governing how businesses collect, use, store or share personal data. Outside the new Act, the private sector continues to rely on a narrow set of pre-existing, non-data-protection-specific legal provisions that happen to touch on privacy. Section 250.12 of the Criminal Code 2011 criminalises unlawful eavesdropping, surveillance and breach of the privacy of messages as a misdemeanour, and Article II of the Constitution guarantees a general right to personal privacy. According to secondary legal commentary, these remain the only private-sector-applicable privacy provisions in Marshall Islands law, a gap the enactment of the 2025 Act does not close. A secondary tracker reports that the Act's effective date falls approximately twelve months after certification, which would place full commencement around November 2026; this could not be confirmed against the primary text's own commencement clause this cycle, and should be treated as an unconfirmed secondary claim pending verification. #### Outlook The central open question for the Marshall Islands' regulatory framework is whether the government intends, at some future point, to extend data-protection regulation beyond the government sector to cover private-sector controllers and processors. The enacted Act, as currently understood, does not itself signal such an intention, and the residual Criminal Code and constitutional provisions remain the only applicable private-sector privacy protections. Confirmation of the Act's actual commencement date against primary statute text, rather than secondary-source estimation, would also materially clarify the framework's practical timeline. Sources and claims (7) - [DataGuidance](https://www.dataguidance.com/jurisdiction/marshall-islands) — The Republic of the Marshall Islands does not have a general/omnibus personal data protection law. - [DataGuidance](https://www.dataguidance.com/jurisdiction/marshall-islands) — The Republic of the Marshall Islands does not have a general data protection authority. - [DataGuidance](https://www.dataguidance.com/jurisdiction/marshall-islands) — Section 13 of the Constitution of the Republic of the Marshall Islands provides a general right to be free from unreasonable interference in personal choices and from unreasonable intrusions into privacy, operating as the sole constitutional-level privacy protection absent any data-processing statute. - [Republic of the Marshall Islands (hosted copy)](https://www.dataguidance.com/sites/default/files/cc201194.pdf) — Section 250.12 of the Criminal Code 2011 [31 MIRC Ch.1] covers unlawful eavesdropping or surveillance and breach of privacy of messages, framing such conduct as a criminal offence rather than a data-processing obligation. - [Nitijela (RMI Parliament)](https://rmiparliament.org/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0043/2025-0043_1.pdf) — Personal Data Protection Act 2025 (P.L. 2025-43) — Section 408 imposes a duty of confidentiality on any director, employee, consultant, or other person engaged by the 'competent authority' in respect of personal data obtained while performing duties under the Chapter. - [Nitijela (RMI Parliament)](https://www.rmiparliament.org/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0043/2025-0043_1.pdf) — Criminal Code 2011 and the Constitution remain MH's only private-sector-applicable privacy provisions. - [RMI Parliament (Nitijela)](https://www.rmiparliament.org/cms/images/LEGISLATION/PRINCIPAL/2025/2025-0043/2025-0043_1.pdf) — Personal Data Protection Act 2025 (P.L. 2025-43) — Takes effect twelve months after certification (commencement 2025-10-07, calculated general effect ~2026-10-07); binds core Government ministries and agencies only; EPSSO is competent authority. ### MH: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ No comprehensive regime; absent_field_provenance applies to the entire module. Traffic-light rationale — Red No comprehensive regime; absent_field_provenance applies to the entire module. D2 · Lawful Processing — Full Module Record 4 sub-modules · 47 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### MH: D3 Data Subject Rights 5 sub-modules Not assessed ▾ No comprehensive regime for this module; empty claims with explicit rationale per gap discipline. Traffic-light rationale — Not assessed No comprehensive regime for this module; empty claims with explicit rationale per gap discipline. #### Sub-modules (5) #### Access RightRed No statutory subject-access-request right exists. #### Rectification And ErasureRed No statutory rectification or erasure right exists. #### Restriction And ObjectionRed No statutory restriction or objection right exists. #### Data PortabilityRed No statutory portability right exists. #### Deadlines And Response WindowsRed No statutory response deadline exists for any data-subject request, as no such request right is created by RMI law. No subject-access, rectification/erasure, restriction/objection, portability, or statutory response-deadline framework exists in RMI law, as there is no general data-processing statute. Searched for an RMI data-subject-rights provision or minors'-rights age threshold; none found. ### MH: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ No comprehensive controller/processor obligations regime identified. Traffic-light rationale — Red No comprehensive controller/processor obligations regime identified. Periodic update · new data 2026-10-11 #### Controller/Processor Duties The clearest confirmed controller-duty finding this cycle is narrow but directly sourced. Section 408 of the Personal Data Protection Act 2025 provides, in language quoted directly from the primary statute text, that any director, employee, consultant, or other legal or natural person engaged by the competent authority under the relevant chapter must maintain confidentiality of personal data obtained in the performance of their duties. This is a confidentiality obligation attaching specifically to personnel engaged by the competent authority, EPSSO, rather than a general controller or processor duty applying across government bodies more broadly, let alone the private sector. Beyond this confidentiality provision, the Act does not appear to establish a breach-notification duty. No personal-data breach-notification obligation, whether owed to a regulator or to affected individuals and whether or not accompanied by a specified deadline, was located anywhere in Marshall Islands law for any sector. This includes sectors that might otherwise be expected to carry heightened data-handling obligations, such as gambling operators processing significant volumes of personal data in the course of their operations. This is treated as a genuine negative finding reached through direct examination of the primary statute text, rather than as an unresolved research gap: the Act simply contains no such provision for the government sector it covers, and no equivalent instrument exists for the private sector either. No data protection impact assessment, DPIA, requirement or data protection officer, DPO, designation requirement was identified in connection with the Act or any other Marshall Islands instrument. These are significant gaps relative to comparative international frameworks, though they should be read in the context of the Act's overall narrow government-sector scope rather than as isolated omissions within an otherwise comprehensive regime. #### Outlook The confidentiality duty under Section 408, while confirmed, is narrow in application and does not substitute for the breach-notification, DPIA or DPO mechanisms that are absent from Marshall Islands law entirely. Any future amendment extending breach-notification obligations, even within the government sector the Act currently covers, would represent a materially significant development for this module, as would any sign of private-sector-directed controller or processor duties being introduced for the first time. D4 · Controller & Processor — Full Module Record 7 sub-modules · 52 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### MH: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No cross-border transfer regime identified for this JID. Traffic-light rationale — Red No cross-border transfer regime identified for this JID. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 64 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### MH: D6 Sectoral Watch8 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Partial sectoral coverage (financial sector) only; all other sub-modules are gaps. Traffic-light rationale — Amber Partial sectoral coverage (financial sector) only; all other sub-modules are gaps. D6 · Sectoral Watch — Full Module Record 8 sub-modules · 36 words · 5 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### MH: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No adtech/commercial-privacy regime identified. Traffic-light rationale — Not assessed No adtech/commercial-privacy regime identified. #### Sub-modules (6) #### Cookies And TrackersRed No cookie/tracker consent provision exists. #### Dark PatternsRed No dark-pattern prohibition was located. #### Opt Out SignalsRed No opt-out-signal recognition rule was located. #### Clean Rooms And DcrRed No clean-room/data-collaboration rule was located. #### Cross Context AdvertisingRed No cross-context-advertising rule was located. #### Direct MarketingRed No direct-marketing consent or suppression rule was located. No cookie/tracker consent rule, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent/suppression regime exists in RMI law. Searched for an RMI ePrivacy-equivalent or consumer-protection dark-pattern provision; none found. ### MH: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No algorithmic/biometric/surveillance governance regime identified. Traffic-light rationale — Red No algorithmic/biometric/surveillance governance regime identified. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 34 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### MH: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No children/vulnerable-groups data regime identified. Traffic-light rationale — Not assessed No children/vulnerable-groups data regime identified. #### Sub-modules (5) #### Age VerificationRed No age-verification duty exists. #### Parental ConsentRed No parental-consent mechanism exists. #### Minor Profiling BansRed No minor-profiling prohibition exists. #### Education SettingsRed No education-settings-specific data rule exists. #### Dependent AdultsRed No dependent-adults data protection was located. No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings data rule, or dependent-adults protection exists in RMI law. Searched for an RMI minors'-data or children's-design-code provision; none found. ### MH: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No general enforcement/redress regime; only a narrow criminal-law penalty exists. Traffic-light rationale — Red No general enforcement/redress regime; only a narrow criminal-law penalty exists. Periodic update · new data 2026-10-25 #### Enforcement & Redress The Personal Data Protection Act 2025 sets out remedies for contraventions committed by core Government ministries and agencies, the only bodies the Act binds. Those remedies expressly exclude compensatory relief against government agencies, meaning that even within the Act's own public-sector scope, affected individuals cannot obtain compensation from the government bodies responsible for a contravention. No penalty schedule applicable to private-sector data handling has been located, and, consistent with the Act's scope limitation, no private right of action against commercial controllers exists absent a general data-protection law covering the private sector. #### Outlook As the Act's effective date around 7 October 2026 arrives, its government-sector enforcement and remedy provisions move from statute to active application, giving affected individuals a defined (if compensation-limited) complaint pathway against Government ministries and agencies for the first time. That pathway remains bounded by the exclusion of compensatory relief against government bodies, and it does not create any enforcement or redress mechanism reaching private-sector data handling, which continues to fall outside any statutory scheme. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 51 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (23 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 13-14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16-17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 33-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties