Gibraltar. Comprehensive data protection. Act
DPA 2004Data Protection Act 2004 (Gibraltar)
In force
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Supplements the Gibraltar GDPR with exemptions, the Information Commissioner's powers and enforcement, and law enforcement processing rules in Part III. Gibraltar's ePrivacy rules sit separately in the Communications (Personal Data and Privacy) Regulations 2006.
- Key themes
- Unique features
The GRA acts as both communications regulator and data protection authority.
- SaaS relevance
Sets the procedural and enforcement framework for SaaS providers within Gibraltar GDPR scope.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- See Gibraltar GDPR
- DPO
- Conditional
- Cross-border transfers
- See Gibraltar GDPR
§3Dates
- Key dates
- Adopted
- In force
- Extensively amended 2018 to supplement GDPR and transpose LED (Part III); amended by the Data Protection Regulations 2026
§4Text and authority
- Text
- Authoritative text gibraltarlaws.gov.gi
- Authority
- Gibraltar Regulatory Authority (as Information Commissioner)
§5Where it applies
- Domestic law of
- Gibraltar