British Virgin Islands. Comprehensive data protection. Act
BVI DPAData Protection Act, 2021 (No. 3 of 2021)
In force
§1Summary
- Synopsis
Data protection law based on general, notice and choice, disclosure, security, retention, integrity and access principles, with criminal penalties and a private right of action.
- Key themes
- Unique features
No proactive breach notification duty; Commissioner office unstaffed.
- SaaS relevance
BVI companies using SaaS must ensure adequate protection for exports of data.
§2Obligations
- Extraterritorial
- No
- Breach notification
- None (only after enforcement notice)
- DPO
- No
- Cross-border transfers
- Adequacy or exceptions (consent, contract)
- Maximum penalty
- USD 500,000 (companies); USD 100,000 and/or 5 years (individuals)
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text bvi.gov.vg
- Authority
- Office of the Information Commissioner (not yet staffed)
§5Where it applies
- Domestic law of
- British Virgin Islands
§6Sources and verification
- Sources consulted
- Verification
High confidence.