Data protection & privacy law in Gibraltar (2026)

Legal framework

Gibraltar GDPR + Data Protection Act 2004 (as amended by the Data Protection Regulations 2026); enforced by the Gibraltar Regulatory Authority (GRA) as sole supervisory authority

Key points: data & privacy in Gibraltar

1. 01Primary law

   The regime is a GDPR-equivalent framework: the Gibraltar GDPR (post-Brexit retained GDPR) together with the Data Protection Act 2004, which addresses derogations, exemptions and national-specific provisions.

   gra.gi gibraltarlaws.gov.gi

2. 02Supervisory authority

   The Gibraltar Regulatory Authority (GRA) is the sole data protection authority. It investigates complaints, issues guidance, can serve information notices (with a 21-day response requirement) and impose administrative fines and penalties on controllers and processors.

   gra.gi gra.gi

3. 032026 Treaty-linked reforms

   The Data Protection Regulations 2026, adopted after the UK–EU Treaty on Gibraltar, amend the Gibraltar GDPR and DPA 2004 — notably by replacing references to UK adequacy regulations with references to European Commission adequacy decisions and imposing an interpretive duty aligned with EU law.

   gibraltarlaw.com gibraltarlaws.gov.gi

4. 04Data subject rights & breach notification

   Individuals enjoy full GDPR-style rights (information, access, rectification, erasure, restriction, portability, objection, and rights around automated decision-making). Controllers must notify the GRA of qualifying personal data breaches without undue delay and within 72 hours, and notify affected individuals where high risk arises.

   gra.gi dlapiperdataprotection.com

5. 05Cross-border transfers

   Gibraltar is no longer treated as a third country for inbound personal data transfers from the EEA under the new Treaty arrangements, removing the need for Chapter V safeguards. Outbound transfers from Gibraltar rely on adequacy findings (including to the UK) and standard GDPR transfer mechanisms.

   gra.gi dlapiperdataprotection.com

6. 06Scope of application

   The regime applies to controllers and processors established in Gibraltar and to processing of Gibraltar data subjects' personal data by entities offering goods/services or monitoring behaviour in Gibraltar, tracking the GDPR's material and territorial scope.

   gra.gi gdprlocal.com

Timeline of decisions

1. 22 Jul 2025Decision · official
   European Commission begins renewal of UK adequacy, sustaining Gibraltar data flows

   The Commission confirmed the UK continues to offer adequate protection under the new Data (Use and Access) Act, after extending existing adequacy decisions to 27 December 2025. Because Gibraltar's regime mirrors the UK's and data flows freely to the UK, this directly underpins Gibraltar's cross-border transfer position.

   EDPB

2. 18 Apr 2022Enforcement
   GRA fines Royal Gibraltar Police £10,000 for multiple breaches

   The Information Commissioner imposed a £10,000 penalty on the RGP for violations of the DPA 2004 and Gibraltar GDPR involving the personal data of hundreds of serving and retired officers. It is the largest publicly reported Gibraltar data-protection fine and signalled enforcement against public bodies.

   DataGuidance

3. 1 Jan 2021Law · official
   Gibraltar GDPR takes effect after the Brexit transition

   At the end of the EU exit transition period, the EU GDPR was superseded domestically by the 'Gibraltar GDPR', sitting alongside the retained DPA 2004. This established the current two-pillar framework supervised by the GRA as Information Commissioner.

   Gibraltar Regulatory Authority

4. 7 Aug 2020Enforcement · official
   GRA fines Royal Gibraltar Police £5,000 for unlawful disclosure

   The GRA fined the RGP £5,000 after pocketbook entries and witness accounts from an investigation were disclosed to the wrong recipient. It was one of the first significant public-sector enforcement actions under the Gibraltar regime.

   Gibraltar Regulatory Authority

5. 1 Jan 2019Law · official
   EU Exit Regulations 2019 create the 'Gibraltar GDPR'

   The Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 transposed Regulation (EU) 2016/679 into Gibraltar national law so the standard would survive Brexit. This is the legal vehicle that produced the Gibraltar GDPR.

   UK Government (DCMS adequacy framework)

6. 25 May 2018Law · official
   EU GDPR becomes directly applicable in Gibraltar

   As part of the EU via the UK, Gibraltar became subject to the directly applicable EU General Data Protection Regulation, modernising rights, accountability obligations and large fining powers. This set the substantive standard later retained as the Gibraltar GDPR.

   Gibraltar Regulatory Authority

7. 1 Jan 2018Law · official
   Data Protection Act 2004 amended to align with EU GDPR

   The Data Protection Act 2004 (Amendment) Regulations 2018 updated Gibraltar's data-protection law to give effect to the EU GDPR, embedding modern data-security and breach-notification requirements. It set the standard later retained as the Gibraltar GDPR.

   Laws of Gibraltar

8. 1 Jan 2006Law · official
   Communications (Personal Data and Privacy) Regulations 2006

   Gibraltar implemented EU ePrivacy rules governing privacy and personal data in electronic communications (cookies, traffic data, direct marketing), complementing the Communications Act's online-services regime.

   Laws of Gibraltar

9. 1 Jan 2004Law · official
   Data Protection Act 2004 enacted, transposing EU Directive 95/46/EC

   Gibraltar's foundational data-protection statute transposed the 1995 EU Data Protection Directive, establishing core processing principles, data-subject rights and a supervisory Commissioner (later the GRA). Brought into operation around 2006, the DPA 2004 remains in force as supplementary national law.

   Laws of Gibraltar

10. 1 Jan 2004Law · official
    Data Protection Act 2004 enacted

    Gibraltar's foundational data-protection statute established the legal architecture for processing personal data 'by automated means or not' and the supervisory authority later designated as the Gibraltar Regulatory Authority. It underpins all subsequent automated-processing and profiling controls relevant to AI.

    Gibraltar Regulatory Authority

Sources

1. 1.gra.gi/data-protection
2. 2.gra.gi/data-protection/faqs
3. 3.gra.gi/data-protection/reporting-a-data-breach
4. 4.gra.gi/data-protection/legislation/acts-regs
5. 5.gra.gi/data-protection/brexit
6. 6.gibraltarlaws.gov.gi/legislations/data-protection-act-2004-1046/version/01-01-2021/downloa
7. 7.gibraltarlaws.gov.gi/uploads/legislations/data-protection/2004-01/2026=096.pdf
8. 8.gibraltarlaw.com/insights/post/102nbws/data-protection-changes-now-in-effect-what-gibr
9. 9.dlapiperdataprotection.com/index.html?t=breach-notification&c=GI
10. 10.dlapiperdataprotection.com/index.html?t=transfer&c=GI
11. 11.gdprlocal.com/gibraltar-data-protection-practices-and-regulations/