--- title: "PW Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/pw-data-protection-privacy-regulation/ source_html: /jurisdictions/palau/index.html description: "PW data protection and privacy regulation: 10 categories, 23 claims, updated 2026-11-03. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 7fc688586a1faa66ea12d9fb7f15efc82cc25c675adfe10be76854839756a360 generator: "fe-fleet/md-twin@1.0" --- # PW Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap Last updated 2026-11-03 · 10 categories · 23 claims · 15 sources in the cumulative register Download report (PDF) Expand all Palau's data-protection posture is understood to have shifted materially with the signing of the Cybersecurity Act (RPPL 12-8) on 21 July 2026. Data collected 2026-11-01 · Data published 2026-11-03 AI-assembled from cited sources Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress. Evidence re-verified: 2026-11-03 · Position last changed: 2026-11-03 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=PALAU)[Build Report](/reports/?j=PALAU)[Compare](/compare/?j=PALAU) Framework posture Unregulated gap 7 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Levellers Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 7 / 10 modules assessed 0 Confirmed · 6 Probable · 1 Uncertain · 3 Not yet assessed 10 Categories 7 Red categories 58 Sub-modules 23 Claims 0 Tier-1 sources Traffic-light mix 7 red 3 n/a (sums to 10 rendered categories; click to filter) 7 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 726 Full executive summary 644 ###### Latest update · 3 November 2026 #### Lead Signal Palau's signing of the Cybersecurity Act (RPPL 12-8) on 21 July 2026 is understood to be the first comprehensive national framework the Republic has adopted that touches digital security and the safeguarding of data, establishing a Bureau of Cybersecurity within government. Reporting on the signing indicates that the Act creates a centralised breach-reporting system under the Bureau and is understood to require government agencies to notify affected individuals when a breach occurs. The precise notification deadline and the threshold that triggers the duty could not be confirmed from the sources located, so the operative detail of how quickly, and under what circumstances, affected individuals must be told remains open. #### Other Developments Palau continues to have no dedicated data-protection authority. Oversight of data-security matters affecting government systems is understood to sit instead with the newly created Bureau of Cybersecurity, a body built for security incident handling rather than for general privacy regulation. No general data-protection statute covering the private sector has been identified, and the Cybersecurity Act, on the reporting available, is government-scoped: it does not appear to create data-protection obligations reaching private-sector controllers or processors. Whether Title 6 of the Palau National Code (the Privacy Act) offers any route for private-sector data disputes was not confirmed from the material reviewed. #### Cross-Monitor Connections The Bureau of Cybersecurity's creation and its breach-reporting mandate touch ground also tracked under financial integrity, given that incident-reporting duties placed on government systems can intersect with regulatory expectations for institutions handling citizen and financial data, though no finding here extends into that territory beyond flagging the structural overlap. #### Outlook The near-term question for Palau's data-protection landscape is whether the Cybersecurity Act's government-scoped breach-notification duty is followed by an extension to private-sector controllers, and whether the underlying statute text surfaces to confirm notification deadlines and penalty provisions that remain unconfirmed at this stage. Until a dedicated data-protection authority or private-sector statute emerges, Palau's regime is best read as security-incident governance for government systems rather than a general data-protection framework. 1 earlier update not shown here. ###### Standing brief · as of 18 October 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Palau's data-protection posture is understood to have shifted materially with the signing of the Cybersecurity Act (RPPL 12-8) on 21 July 2026. The Act is reported to establish a Bureau of Cybersecurity under the Ministry of Public Infrastructure and Industries, headed by a Chief Information Security Officer, with a mandate covering minimum cybersecurity standards, breach notification and agency data-protection duties. This sits alongside the pre-existing Privacy Act (6 PNCA §§205-206), which requires agencies maintaining personal information to protect it from loss, unauthorized access, modification, disclosure or misuse, and not to retain it longer than its lawful purpose requires. Reporting attributes to the Cybersecurity Act a penalty regime of civil fines of up to US$10,000 per violation, or up to five years' imprisonment for intentional misconduct, enforced through a centralised incident-reporting system. Whether the enacted text, as signed, retains the figures as reported from the Senate-passed version has not been separately confirmed from primary text. #### Other Developments The National Cybersecurity Strategy and Policy 2026-2030 was signed with ITU support on 5 May 2026, described as a step toward strengthening Palau's digital resilience and cybersecurity governance framework. The pre-existing Digital Residency Program Cyber Security Regulation, made under RPPL 11-14, continues to require ISO/IEC 27001-aligned cybersecurity policies and procedures for the Digital Residency Office, and cites the Privacy Act as a governing data-protection duty for that programme. #### Cross-Monitor Connections A draft Digital Payment System Bill (SB 12-35) proposing that personal and financial data may be stored outside Palau in places approved by the Ministry, with no defined approval standard, intersects with payment-system and stablecoin oversight questions more squarely in the remit of world-payments; that proposal remains unenacted and is not analysed further here. #### Outlook The Cybersecurity Act's practical reach turns on questions the enacted text alone can answer: whether its data-protection and breach-notification duties extend to private-sector controllers or remain confined to government agencies and critical infrastructure, and whether the breach-notification regime carries a defined deadline or risk threshold. Until the enacted text is read against the Senate-passed version, the scope and stability of Palau's new enforcement posture should be treated as reported rather than confirmed in its particulars. Read full brief · 726 words ###### Latest update · 25 October 2026 #### Regulatory Status Palau's data-protection-adjacent regulatory landscape tightened materially with the signing of RPPL 12-8, the Cybersecurity Act, on 21 July 2026, following unanimous Senate passage the day before. The Act establishes Palau's first dedicated cybersecurity regulator, the Bureau of Cybersecurity, situated within the Ministry of Public Infrastructure and Industries and led by a Chief Information Security Officer appointed by the President and confirmed by the Senate. It is reported to carry an initial appropriation of US$150,000, with a statutory requirement to seek further annual funding from the Olbiil Era Kelulau. On obligations, the Act is understood to require the new Bureau to build a centralised incident-reporting system and to require government agencies to notify affected individuals following a breach, though no specific notification deadline has yet been located. This duty now sits alongside an older, narrower, and more precisely specified obligation: under the Digital Residency Program Cyber Security Regulation, made under RPPL 11-14, all breaches and compromises of personally identifiable information must be reported immediately to the Information Security Manager. The two regimes have not been shown to be formally reconciled, and both currently appear to bind government and programme-level actors rather than the private sector generally; Palau continues to have no general private-sector data-protection statute. On enforcement, RPPL 12-8 is reported to carry civil fines of up to US$10,000 per violation for failures to safeguard confidential and personal data, and criminal penalties of up to five years' imprisonment for intentional misconduct. These figures come from local press reporting on the Act rather than from independent review of the enacted text, and the precise scope of liability — whether reaching beyond government officials — remains unconfirmed. No enforcement action under the new provisions has been identified to date, consistent with the Bureau's own early-stage institutional build-out. Outside this cluster of developments, no change was found to Palau's lawful-processing rules, data-subject-rights provisions, cross-border transfer regime, sectoral overlays, adtech or commercial-privacy rules, algorithmic or biometric governance, or children's-data protections; Palau has no AI-specific law and continues to be governed in that space, where at all, only indirectly through adjacent instruments. #### Outlook The principal open questions are whether RPPL 12-8's provisions extend beyond government agencies to private-sector controllers, whether the Bureau of Cybersecurity issues implementing regulations or a notification-timeline standard, and how the Act's broader duties are reconciled with the pre-existing Digital Residency Program reporting channel. Filling of the Chief Information Security Officer post and the Bureau's funding trajectory through its first legislative budget cycle are also markers worth tracking as indicators of how quickly this new institutional architecture becomes operationally effective. ###### Standing brief · as of 18 October 2026 #### Regulatory Status Palau's data-protection posture is reported to be tightening: the Cybersecurity Act (RPPL 12-8, signed 21 July 2026) and the National Cybersecurity Strategy 2026-2030 (signed 5 May 2026) together extend Palau's data-protection enforcement posture beyond the pre-existing Privacy Act (6 PNCA §§205-206). The Privacy Act continues to require agencies maintaining personal information to protect it from loss, unauthorized access, modification, disclosure or misuse, and not to retain it longer than its lawful purpose requires. The Cybersecurity Act is understood to add a dedicated Bureau of Cybersecurity, a mandatory breach-notification duty with a centralised incident-reporting system, and a civil and criminal penalty regime of up to US$10,000 per violation or up to five years' imprisonment for intentional misconduct. The enacted text of the Act has not been independently retrieved, so its precise scope — including whether it reaches private-sector controllers — is drawn from secondary reporting rather than confirmed primary wording. #### Outlook Palau's framework remains agency-scoped in its core Privacy Act and newly extended by the Cybersecurity Act; whether that extension reaches private-sector controllers, and on what breach-notification timeline, awaits confirmation against the enacted gazetted text. Read full brief · 644 words Key regulatory facts for PW Regulatory Dimension PW Standing Position Jurisdiction PW (PW) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 23 sourced findings) Regulator & Framework Absence of any identified omnibus or sectoral DP statute and absence of a supervisory authority; evidenced only by secondary trackers, not a primary instrument. Lawful Processing & Special Data No statute found to carry lawful-basis or special-category rules. Data Subject Rights No rights-conferring statute identified. Controller/Processor Duties No controller/processor obligations regime identified. Primary Instruments Cited PW Official Instrument (islandtimes.org palau-extends-interim-ship-regis), Levellers, PW Official Instrument (palaugov.pw Digital-Residency-Program-Cyber-), SEAP, PINA Last Confirmed / Updated 2026-11-03 (15 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### PW: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ Absence of any identified omnibus or sectoral DP statute and absence of a supervisory authority; evidenced only by secondary trackers, not a primary instrument. Traffic-light rationale — Red Absence of any identified omnibus or sectoral DP statute and absence of a supervisory authority; evidenced only by secondary trackers, not a primary instrument. #### Sub-modules (5) #### Regulator And AuthorityRed No DPA or privacy commissioner identified for Palau. Claims (4): - Palau has no dedicated data-protection authority; the Bureau of Cybersecurity has an adjacent government-data-security remit. - Cybersecurity Act (RPPL 12-8) — A Bureau of Cybersecurity under the Ministry of Public Infrastructure and Industries, headed by a Chief Information Security Officer, with a mandate including minimum cybersecurity standards, breach notification and agency data-protection duties - RPPL 12-8 amends Title 15 of the Palau National Code to establish a Bureau of Cybersecurity under the Ministry of Public Infrastructure and Industries, led by a Chief Information Security Officer appointed by the President with Senate confirmation. - Palau data-protection regulatory landscape — no dedicated data protection authority: true #### Act And InstrumentsRed No omnibus personal-data-protection Act identified; general public-records/consumer/telecoms statutes do not constitute a comprehensive DP regime so far as located. Claims (4): - The Cybersecurity Act (RPPL 12-8) establishes a government-scoped cybersecurity and data-safeguarding framework, not a general private-sector data-protection law. - Privacy Act, 6 PNCA §§205-206 — Agencies maintaining personal information shall ensure it is protected from loss, unauthorized access, modification, disclosure or misuse, and not retained longer than necessary for its lawful purpose - RPPL 12-8 (Cybersecurity Act) — President Surangel Whipps Jr. signed RPPL 12-8 into law on 21 July 2026, following Senate final passage (13-0) on 20 July 2026. - Privacy Act, 6 PNCA §§205-206 — an agency maintaining personal information shall protect it from loss, unauthorized access, modification, disclosure or misuse, and may not retain it longer than necessary for its lawful purpose #### Material ScopeRed No material-scope test (what data/processing is caught) could be sourced absent an identified statute. Claims (1): - Agencies must report breaches through a centralised system and notify affected individuals, though the notification deadline is unconfirmed. #### Territorial ScopeRed No territorial-scope/establishment or targeting test could be sourced absent an identified statute. #### Regulator Registration And FilingRed No registration, notification or fee duty identified; no regulator exists to administer one. No comprehensive data-protection or privacy statute, and no dedicated data-protection authority, has been identified for the Republic of Palau. Secondary jurisdiction trackers (OneTrust DataGuidance) list Palau among the Pacific Island jurisdictions for which no specific personal-data-protection legislation has been adopted, and Palau does not appear in IAPP's count of countries with a comprehensive national privacy law in force. Targeted searches for a Palau Data Protection Act, an Electronic Transactions Act, a Cybercrime Act, a Consumer Protection Act, and for any National Communications Corporation privacy rules returned no primary legislative text, gazette notice, or regulator webpage. No primary (T1) instrument could therefore be verified; this module rests on T3/T4 commentary only. Periodic update · new data 2026-11-03 #### Regulator & Framework Palau has no dedicated data-protection authority. Data-security oversight of government systems instead sits with the newly created Bureau of Cybersecurity. This body was established by the Cybersecurity Act (RPPL 12-8), signed into law on 21 July 2026, which is reported to mark the Republic's first comprehensive national framework addressing digital security and the safeguarding of data. No general data-protection statute covering the private sector has been located, and Title 6 of the Palau National Code was not confirmed to offer a route reaching private-sector disputes. The overall shape of Palau's regime at this stage is one of government-focused security governance rather than a general privacy framework with an independent regulator and a remit reaching commercial actors. #### Outlook The framework question for Palau going forward is whether a dedicated privacy regulator or a private-sector-facing statute emerges to sit alongside the Bureau of Cybersecurity's government-focused remit. Until such a development occurs, oversight of data matters outside government systems remains without a clearly identified home. 1 earlier distinct update(s) Periodic update · new data 2026-10-25 #### Regulator & Framework Palau has created a dedicated cybersecurity regulator for the first time. RPPL 12-8, the Cybersecurity Act, amends Title 15 of the Palau National Code to establish a Bureau of Cybersecurity within the Ministry of Public Infrastructure and Industries. The Bureau is to be led by a Chief Information Security Officer, appointed by the President and confirmed by the Senate, giving the role a level of political accountability consistent with a body expected to exercise enforcement and standard-setting functions across government. The Act itself completed the legislative process with unanimous Senate passage on 20 July 2026 and was signed into law by President Surangel Whipps Jr. the following day, 21 July 2026. The new Bureau is reported to receive an initial appropriation of US$150,000, with a statutory requirement to submit annual budget requests to the Olbiil Era Kelulau, Palau's national legislature, for ongoing funding. This is a modest sum for standing up a new regulatory function, and it signals that the Bureau's operational capacity — staffing, systems, any implementing regulations — is at an early, foundational stage rather than mature. Before this Act, Palau had no dedicated cybersecurity authority of this kind; the closest analogue in the existing framework was the narrower Digital Residency Program Cyber Security Regulation, which creates obligations specific to that programme rather than a general cybersecurity or data-protection regulator with economy-wide remit. The Act's passage is also reported to have occurred alongside the creation of a separate Presidential technology office, raising questions in local commentary about possible overlap between that office and the new Bureau's functions. No resolution of that overlap question has been located; it is noted here as a live institutional question rather than a settled fact, since the two bodies' precise division of responsibility has not been confirmed from primary sources. Taken together, the Bureau of Cybersecurity represents Palau's first general-purpose institutional architecture for cybersecurity governance, built through amendment to an existing title of the national code rather than through a wholly freestanding instrument. Its creation is a structural development of real significance for a small-state regulatory system that has, to date, addressed data-related risk only through narrower, programme-specific instruments such as the Digital Residency Program regulation. Whether the Bureau in practice absorbs or coordinates with those narrower regimes, or operates as a parallel structure, is not yet clear from the reporting available. #### Outlook The principal developments to watch are whether the Chief Information Security Officer position is filled and confirmed, whether the Bureau issues any implementing regulations or standards following its creation, and whether the reported overlap with the new Presidential technology office is clarified through any formal delineation of functions. The Bureau's budget trajectory, given its statutory obligation to make annual requests to the legislature, is also a marker worth tracking, since appropriations levels will indicate how quickly the institution is expected to scale from its initial US$150,000 base. Access to the full enacted text of RPPL 12-8 would materially sharpen understanding of the Bureau's precise powers and its relationship to existing instruments such as the Digital Residency Program regulation. Sources and claims (8) - [https://islandtimes.org/palau-extends-interim-ship-registry-contract-through-cybersecurity-act-rider/](https://islandtimes.org/palau-extends-interim-ship-registry-contract-through-cybersecurity-act-rider/) — Cybersecurity Act (RPPL 12-8) — A Bureau of Cybersecurity under the Ministry of Public Infrastructure and Industries, headed by a Chief Information Security Officer, with a mandate including minimum cybersecurity standards, breach notification and agency data-protection duties - [Levellers](https://www.levellers.ai/what-is/ai-regulation-palau) — Palau has no dedicated data-protection authority; the Bureau of Cybersecurity has an adjacent government-data-security remit. - [Island Times News](https://islandtimes.org/palau-extends-interim-ship-registry-contract-through-cybersecurity-act-rider/) — The Cybersecurity Act (RPPL 12-8) establishes a government-scoped cybersecurity and data-safeguarding framework, not a general private-sector data-protection law. - [https://www.palaugov.pw/wp-content/uploads/Digital-Residency-Program-Cyber-Security-Regulation.pdf](https://www.palaugov.pw/wp-content/uploads/Digital-Residency-Program-Cyber-Security-Regulation.pdf) — Privacy Act, 6 PNCA §§205-206 — Agencies maintaining personal information shall ensure it is protected from loss, unauthorized access, modification, disclosure or misuse, and not retained longer than necessary for its lawful purpose - [Levellers](https://www.levellers.ai/what-is/ai-regulation-palau) — RPPL 12-8 amends Title 15 of the Palau National Code to establish a Bureau of Cybersecurity under the Ministry of Public Infrastructure and Industries, led by a Chief Information Security Officer appointed by the President with Senate confirmation. - [Island Times News](https://islandtimes.org/palau-extends-interim-ship-registry-contract-through-cybersecurity-act-rider/) — RPPL 12-8 (Cybersecurity Act) — President Surangel Whipps Jr. signed RPPL 12-8 into law on 21 July 2026, following Senate final passage (13-0) on 20 July 2026. - [Levellers](https://www.levellers.ai/what-is/ai-regulation-palau) — Palau data-protection regulatory landscape — no dedicated data protection authority: true - [https://www.palaugov.pw/wp-content/uploads/Digital-Residency-Program-Cyber-Security-Regulation.pdf](https://www.palaugov.pw/wp-content/uploads/Digital-Residency-Program-Cyber-Security-Regulation.pdf) — Privacy Act, 6 PNCA §§205-206 — an agency maintaining personal information shall protect it from loss, unauthorized access, modification, disclosure or misuse, and may not retain it longer than necessary for its lawful purpose ### PW: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ No statute found to carry lawful-basis or special-category rules. Traffic-light rationale — Red No statute found to carry lawful-basis or special-category rules. D2 · Lawful Processing — Full Module Record 4 sub-modules · 34 words · 2 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### PW: D3 Data Subject Rights 5 sub-modules Not assessed ▾ No rights-conferring statute identified. Traffic-light rationale — Not assessed No rights-conferring statute identified. #### Sub-modules (5) #### Access RightRed absent_field_provenance: no subject-access-request framework located. #### Rectification And ErasureRed No erasure/rectification right located. #### Restriction And ObjectionRed No restriction/objection right located. #### Data PortabilityRed No portability right located. #### Deadlines And Response WindowsRed No statutory response deadline located. No statutory access, rectification, erasure, restriction, objection, or portability rights, and no statutory response deadline, could be located for Palau data subjects outside of any sector-specific regime. ### PW: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ No controller/processor obligations regime identified. Traffic-light rationale — Red No controller/processor obligations regime identified. Periodic update · new data 2026-11-03 #### Controller/Processor Duties The Cybersecurity Act (RPPL 12-8), signed into law on 21 July 2026, establishes a centralised breach-reporting system housed within the Bureau of Cybersecurity, and government agencies are understood to be required to notify affected individuals when a breach occurs. The deadline for notification and the threshold event that triggers the duty have not been confirmed from the sources reviewed, and no penalty schedule for non-compliance has surfaced either. On the reporting available, the duty is scoped to government agencies rather than extending to private-sector controllers or processors, so entities outside government are not understood to carry an equivalent breach-notification obligation under this instrument. #### Outlook Confirmation of the statute's operative provisions, including the notification deadline and any penalty regime, would settle how substantial this duty is in practice. Whether the government-scoped duty is later extended to reach private-sector data handlers is the development worth watching; on the present record, no such extension has occurred. Periodic update · new data 2026-10-25 #### Controller/Processor Duties Palau now has two distinct, and only partially overlapping, breach-notification regimes in force. The first arises under RPPL 12-8, the Cybersecurity Act signed on 21 July 2026, which is understood to require the Bureau of Cybersecurity to establish a centralised incident-reporting system and to require government agencies to notify affected individuals following a data breach. No specific notification deadline for this duty has been located in the reporting reviewed, so whether the obligation operates on an immediate basis, a fixed number of days, or a more general promptness standard remains an open question pending sight of the enacted text or any implementing regulation. The second regime is narrower in scope but considerably more precise in its terms, and predates the Cybersecurity Act. Under the Digital Residency Program Cyber Security Regulation, made pursuant to RPPL 11-14, all breaches and compromises of personally identifiable information must be reported immediately to the Information Security Manager. This is a program-specific duty tied to participants and data within Palau's Digital Residency Program rather than a general controller obligation applicable across government or the private sector, and it was already operative before the new Act existed. Its standard — immediate reporting to a named official — is notably more concrete than what is currently known about the Cybersecurity Act's broader, agency-directed duty. The practical picture for anyone assessing Palau's breach-notification landscape is therefore one of layering rather than replacement: a newer, broader, agency-focused duty under RPPL 12-8 sits alongside an older, narrower, programme-specific duty under the Digital Residency Program regulation, with the two not yet shown to be formally reconciled or cross-referenced. Both duties currently appear to bind government bodies and programme administrators rather than private-sector controllers generally, consistent with the absence of any general private-sector data-protection statute in Palau. Whether the Cybersecurity Act's duty is intended to supersede, incorporate, or simply run in parallel with the Digital Residency Program's existing reporting channel has not been confirmed from material available for this review. #### Outlook The clearest marker of forward movement here would be publication of the Cybersecurity Act's implementing detail — a specific notification timeline, a defined breach threshold, and clarity on whether the duty reaches entities beyond government agencies. A second marker would be any formal statement reconciling the Act's centralised incident-reporting system with the pre-existing immediate-reporting duty under the Digital Residency Program regulation, since two unreconciled reporting channels create practical ambiguity for anyone handling personal data connected to that programme. Until such clarification appears, the agency-directed duty under RPPL 12-8 should be read as the newer and still less precisely defined of Palau's two operative breach-notification obligations. D4 · Controller & Processor — Full Module Record 7 sub-modules · 29 words · 6 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### PW: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No cross-border transfer regime identified. Traffic-light rationale — Red No cross-border transfer regime identified. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 37 words · 1 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### PW: D6 Sectoral Watch8 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sectoral overlay regime confirmed; EU Data Act is out of scope for this non-EU JID. Traffic-light rationale — Red No sectoral overlay regime confirmed; EU Data Act is out of scope for this non-EU JID. D6 · Sectoral Watch — Full Module Record 8 sub-modules · 39 words · 2 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### PW: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No adtech/commercial-privacy regime identified. Traffic-light rationale — Not assessed No adtech/commercial-privacy regime identified. #### Sub-modules (6) #### Cookies And TrackersRed No cookie-consent provision located. #### Dark PatternsRed No dark-pattern prohibition located. #### Opt Out SignalsRed No opt-out-signal recognition rule located. #### Clean Rooms And DcrRed No clean-room/data-collaboration rule located. #### Cross Context AdvertisingRed No cross-context-advertising rule located. #### Direct MarketingRed No electronic-marketing consent or suppression rule located. No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent rule could be located for Palau. ### PW: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No algorithmic/biometric governance regime identified. Traffic-light rationale — Red No algorithmic/biometric governance regime identified. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 20 words · 1 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### PW: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No children/vulnerable-groups DP regime identified. Traffic-light rationale — Not assessed No children/vulnerable-groups DP regime identified. #### Sub-modules (5) #### Age VerificationRed No age-of-consent provision located. #### Parental ConsentRed No parental-consent mechanism located. #### Minor Profiling BansRed No minor-profiling prohibition located. #### Education SettingsRed No education-settings-specific rule located. #### Dependent AdultsRed No dependent-adults protection rule located. No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection could be located for Palau under a dedicated DP instrument. ### PW: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No regulator exists to hold powers, issue penalties, or generate an enforcement record. Traffic-light rationale — Red No regulator exists to hold powers, issue penalties, or generate an enforcement record. Periodic update · new data 2026-10-25 #### Enforcement & Redress Palau's new Cybersecurity Act attaches a concrete penalty structure to failures to safeguard confidential and personal data. RPPL 12-8 is reported to set civil fines of up to US$10,000 per violation for such failures, with criminal penalties of up to five years' imprisonment reserved for intentional misconduct. This dual civil-criminal structure gives Palau, for the first time, a penalty regime specifically tied to data-handling failures rather than relying solely on general criminal-law provisions or the narrower sanctions attached to the pre-existing Digital Residency Program framework. The precision of this penalty information should be read with some caution: it is drawn from local press reporting on the Act's provisions rather than from the enacted statutory text itself, which has not been independently reviewed for this assessment. The reported figures — a US$10,000 per-violation civil fine ceiling and a five-year imprisonment ceiling for intentional misconduct — give a workable sense of the regime's severity, but the precise definitions of what counts as a violation, who may be held liable (government officials specifically, or a broader class of actors), and what procedural mechanism triggers a civil as opposed to a criminal response are not yet confirmed from primary sources. Enforcement capacity for this new regime sits with the newly created Bureau of Cybersecurity, itself funded at only US$150,000 initially and required to seek further funding annually from the Olbiil Era Kelulau. A penalty regime is only as effective as the institution empowered to investigate and act on it, and the Bureau's own build-out — staffing, investigative capacity, any formal enforcement procedure — appears, on current information, to be at an early stage rather than operationally mature. No enforcement action, investigation, or redress mechanism under the new penalty provisions has been identified as having occurred since the Act's signing on 21 July 2026. This enforcement and redress layer should also be read against Palau's pre-existing, narrower compliance structure under the Digital Residency Program Cyber Security Regulation, which imposes its own immediate-reporting duty but whose own penalty or redress mechanism has not been detailed in material reviewed for this assessment. The two regimes are not yet shown to be formally integrated, leaving open how a breach touching both the Digital Residency Program and the Cybersecurity Act's broader government-data provisions would be processed and penalised in practice. #### Outlook The first meaningful test of this new enforcement regime will be whether the Bureau of Cybersecurity, once adequately staffed and funded, brings any civil or criminal action under the Act's penalty provisions, and whether the enacted statutory text, once reviewed, confirms the scope of liability reported in local press coverage. A second marker is whether any formal guidance clarifies the relationship between the Act's penalty structure and the existing Digital Residency Program framework's own compliance mechanisms. Until an enacted-text review or an actual enforcement action occurs, the current picture remains one of a penalty structure newly legislated but not yet tested or fully specified in practice. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 55 words · 3 traced claims · Re-verified 2026-11-03 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties