Gibraltar. Comprehensive data protection. Regulation (as applied)

Gibraltar GDPRGibraltar General Data Protection Regulation (Regulation (EU) 2016/679 as applied in Gibraltar, as amended by the Data Protection Regulations 2026)

In force

Partly verified

Medium confidence. The GRA noted Gibraltar's EU adequacy application as pending and gave no decision; whether the 2026 UK–EU treaty provides a separate data flow mechanism is unconfirmed. Post-2026 fine cap (formerly £17.5m/4%) not verified.

§1Summary

Synopsis

Gibraltar's main data protection regulation, read together with the Data Protection Act 2004. After Brexit it ran as a local copy of the GDPR, and from 15 July 2026 it has been realigned to the EU GDPR (with some derogations) after the UK–EU agreement on Gibraltar.

Key themes

lawful bases
data subject rights
DPO
breach notification
transfers

Unique features

One of the few post-Brexit jurisdictions to re-adopt the EU GDPR text, reflecting the UK–EU Gibraltar arrangement.

SaaS relevance

Applies to Gibraltar-based SaaS (notably the large online gaming and fintech sector) and to non-Gibraltar providers targeting people there.

§2Obligations

Extraterritorial: Yes
Breach notification: Information Commissioner within 72h; individuals if high risk
DPO: Conditional
Cross-border transfers: Chapter V: adequacy/SCCs/BCRs

§3Dates

Key dates

Adopted 27 April 2016
In force 25 May 2018
EU GDPR applied 2018-05-25 to 2020-12-31; 'Gibraltar GDPR' from 2021-01-01; Data Protection Regulations 2026 (dated 2026-05-14) reinstate the EU GDPR text with local derogations from 2026-07-15 following the UK–EU agreement on Gibraltar

§4Text and authority

Text

Authoritative text gibraltarlaws.gov.gi

Authority

Gibraltar Regulatory Authority (as Information Commissioner)

§5Where it applies

Domestic law of: Gibraltar

§6Sources and verification

Sources consulted

Verification

Medium confidence.

Partly verified