Latin America & Caribbean. National jurisdiction.

British Virgin Islands VG

Primary authority: Office of the Information Commissioner (not yet staffed)

Part I

Domestic law

Comprehensive data protection1

BVI DPAData Protection Act, 2021 (No. 3 of 2021)In force
In force from 9 July 2021Data protection law based on general, notice and choice, disclosure, security, retention, integrity and access principles, with criminal penalties and a private right of action.
Synopsis
Data protection law based on general, notice and choice, disclosure, security, retention, integrity and access principles, with criminal penalties and a private right of action.
Key themes
- principles
- criminal offences
- private action
- transfers
Unique features
No proactive breach notification duty; Commissioner office unstaffed.
SaaS relevance
BVI companies using SaaS must ensure adequate protection for exports of data.
Extraterritorial
No
Breach notification
None (only after enforcement notice)
DPO
No
Cross-border transfers
Adequacy or exceptions (consent, contract)
Maximum penalty
USD 500,000 (companies); USD 100,000 and/or 5 years (individuals)
Key dates
- Adopted 2021
- In force 9 July 2021
Text
- Authoritative text bvi.gov.vg
Authority
Office of the Information Commissioner (not yet staffed)
Sources consulted
- dlapiperdataprotection.com
- uwi.edu
Verification
High confidence.
Record
Full record for BVI DPA