Skip to content
World Watch

Cybersecurity law & regulation in British Virgin Islands (2026)

Cybersecurity in British Virgin Islands: sectoral rules.

The British Virgin Islands addresses cybersecurity through a combination of a criminal-law based Computer Misuse and Cybercrime Act (originally 2014, amended 2019, further amendment bill tabled January 2025) and a Data Protection Act (in force July 2021) that imposes security obligations on data controllers without mandating breach notification. There is no comprehensive NIS2-style cybersecurity framework; obligations are fragmented across cybercrime statutes and data-protection and financial-sector rules.

Last verified Official sources first · MethodologyCompare British Virgin Islands with other countries

Legal framework

Computer Misuse and Cybercrime Act 2014 (as amended 2019, 2024/25 amendment pending enactment); Data Protection Act 2021; BVI Financial Services Commission (FSC) supervisory oversight

Key points: cybersecurity in British Virgin Islands

  1. Computer Misuse and Cybercrime Act (CMCA)

    The CMCA 2014, amended in 2019, criminalises unauthorised computer access, data interference, identity theft, cyberbullying, and electronic defamation. It is primarily a criminal-law instrument rather than a preventive or incident-reporting regime.

    laws.gov.vg laws.gov.vg

  2. 2024 Amendment Bill (CMCA)

    A further Computer Misuse and Cybercrime (Amendment) Bill, 2024 was presented to the House of Assembly in January 2025, aiming to broaden offence definitions and align with international standards to avoid blacklisting; its enactment status was pending as of early 2025.

    laws.gov.vg

  3. Data Protection Act 2021, security obligations

    The DPA (in force 9 July 2021) requires data controllers to implement appropriate technical and organisational security measures to protect personal data, broadly tracking UK/EU standards; however, it contains no mandatory breach-notification obligations to regulators or data subjects.

    bvi.gov.vg dlapiperdataprotection.com

  4. No mandatory breach notification

    The DPA does not require data controllers to notify BVI's Information Commissioner or affected individuals of personal data breaches. Voluntary notification is recommended where harm to data subjects is likely, but no statutory deadline or threshold exists.

    dlapiperdataprotection.com applebyglobal.com

  5. FSC financial-sector cybersecurity expectations

    The BVI Financial Services Commission expects regulated financial entities to maintain robust IT security and may require security audits, but there is no standalone, prescriptive cybersecurity regulation for the financial sector equivalent to EU DORA or similar frameworks.

    bvifsc.vg

  6. No critical-infrastructure or NIS2-equivalent regime

    BVI has enacted no legislation governing cybersecurity for critical infrastructure operators, no sector-wide incident-reporting mandate, and no national cybersecurity authority or strategy equivalent to NIS2 or similar regional frameworks.

    laws.gov.vg dataguidance.com

Sources

  1. laws.gov.vg/Laws/computer-misuse-and-cybercrime-act-2014
  2. laws.gov.vg/Laws/computer-misuse-and-cybercrime-amendment-act-2019
  3. laws.gov.vg/index.php/Laws/computer-misuse-and-cybercrime-amendment-bill-2024
  4. bvi.gov.vg/sites/default/files/data_protection_act_2019.pdf
  5. dlapiperdataprotection.com/?t=breach-notification&c=VG
  6. applebyglobal.com/publications/data-protection-guide-british-virgin-islands/
  7. bvifsc.vg/news/industry-updates/industry-circular-2-2025-bvi-fsc-announces-publ
  8. dataguidance.com/jurisdiction/british-virgin-islands
  9. laws.gov.vg/bills

Next for British Virgin Islands: Starting a BusinessEasy

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026