Gibraltar GDPRGibraltar General Data Protection Regulation (Regulation (EU) 2016/679 as applied in Gibraltar, as amended by the Data Protection Regulations 2026)Gibraltar's main data protection regulation, read together with the Data Protection Act 2004. After Brexit it ran as a local copy of the GDPR, and from 15 July 2026 it has been realigned to the EU GDPR (with some derogations) after the UK–EU agreement on Gibraltar.
- Synopsis
Gibraltar's main data protection regulation, read together with the Data Protection Act 2004. After Brexit it ran as a local copy of the GDPR, and from 15 July 2026 it has been realigned to the EU GDPR (with some derogations) after the UK–EU agreement on Gibraltar.
- Key themes
- Unique features
One of the few post-Brexit jurisdictions to re-adopt the EU GDPR text, reflecting the UK–EU Gibraltar arrangement.
- SaaS relevance
Applies to Gibraltar-based SaaS (notably the large online gaming and fintech sector) and to non-Gibraltar providers targeting people there.
- Extraterritorial
- Yes
- Breach notification
- Information Commissioner within 72h; individuals if high risk
- DPO
- Conditional
- Cross-border transfers
- Chapter V: adequacy/SCCs/BCRs
- Key dates
- Adopted
- In force
- EU GDPR applied 2018-05-25 to 2020-12-31; 'Gibraltar GDPR' from 2021-01-01; Data Protection Regulations 2026 (dated 2026-05-14) reinstate the EU GDPR text with local derogations from 2026-07-15 following the UK–EU agreement on Gibraltar
- Text
- Authoritative text gibraltarlaws.gov.gi
- Authority
- Gibraltar Regulatory Authority (as Information Commissioner)
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.The GRA noted Gibraltar's EU adequacy application as pending and gave no decision; whether the 2026 UK–EU treaty provides a separate data flow mechanism is unconfirmed. Post-2026 fine cap (formerly £17.5m/4%) not verified.
- Record
- Full record for Gibraltar GDPR